tools / agent audit / rules / actions with no recognised effect · v0.1.0 · View source · Edit on GitHub
Agent audit rule · v0.1.0
Actions with no recognised effect
These actions are not read-only by HTTP method or annotation, and their names matched nothing the auditor knows, so no other rule could check them. They may move money, change accounts or delete data.
- low base severity
- 3 test fixtures
low unclassified-action
Flagged
// tools.json
1 [
2 {
3 > "name": "frobnicate_widget",
4 "input_schema": {
5 "type": "object",Fix
Review each action and declare what it does in the manifest (`actions: { frobnicate_widget: { effects: [write] } }`), or rename it to say what it does.
Fine
// tools.json
[
{
"name": "frobnicate_widget",
"input_schema": {
"type": "object",
"properties": {}
}
}
]
// agent.json
{
"agent": {
"name": "Widget bot"
},
"actions": {
"frobnicate_widget": {
"effects": [
"write"
]
}
}
}