create_site

2 findings on this tool

1. highexcessive agencyf-r3-create_site

   Tool `create_site` name implies a side effect that is not declared

   `create_site` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

   OWASP LLM08NIST MEASURE-2.6ATLAS T0051CAST-01
2. highsecret exposuref-r10-create_site

   Tool `create_site` exposes secrets or credentials to the agent

   `create_site` appears to read or return secrets, API keys, credentials, or environment variables (Create a new website for a business. Pass a business candidate object from search_businesses to generate a website. Requires authentication via API key (Bearer token). Generate an API key at webzum.com/dashboard/account-settings. The site generation happens in the background. Use get_site_status to check progress. Returns the businessId which can be used to access the site at /build/{businessId}). Values surfaced in the model context are visible to any prompt with injection access; a compromised agent can relay them to an attacker-controlled server.

   fix: Do not expose secrets to the agent: inject them server-side at call time rather than passing them through the model context. If a tool must return a credential, scope it with a capframe-bind time-limited caveat and log every issuance.

   OWASP LLM06NIST MANAGE-2.2ATLAS T0040CAST-01