list_passengers

2 findings on this tool

1. mediumunconstrained inputf-r1-list_passengers

   Tool `list_passengers` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `session_id`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03
2. mediumexcessive agencyf-r5-list_passengers

   Tool `list_passengers` description mentions money but no `money` side-effect is declared

   Description: "List the passengers currently aboard your ship (Shows each passenger's destination station and system, accommodation class, base fare due on delivery, the speed bonus they would pay if delivered right now (it decays as the guarantee window runs down), and the ticks remaining before their fare guarantee expires. Also reports your ship's passenger berths as berths: {"economy": {"total": N, "free": N}, "business": {...}, "first": {...}} — free counts what load_passenger can still fill, remembering that a passenger seated in a higher-class berth occupies that class. Omitted entirely if your ship has no berths.)" -- this references money/payment/refund/etc., but the declared side_effects ([]) don't include `money`. A capframe-bind policy that relies on declared side_effects to scope spend caveats will under-scope this tool.

   fix: Add `money` to the tool's `side_effects` declaration, or rewrite the description to clarify that no actual money moves.

   OWASP LLM08NIST MEASURE-2.6ATLAS T0040CAST-01