generate_geo_page

3 findings on this tool

1. highssrf surfacef-r8-generate_geo_page

   Tool `generate_geo_page` accepts an unconstrained URL / endpoint parameter

   The parameter(s) `webhookUrl` look like URL or endpoint inputs but carry no `pattern` or `enum` constraint. An agent tricked by an indirect-injection payload can invoke this tool with an internal-service URL (e.g. `http://169.254.169.254/`) to exfiltrate cloud metadata, probe internal APIs, or pivot to services the host can reach but the caller cannot.

   fix: Constrain the URL parameter with an allow-list `enum`, or a `pattern` that restricts scheme and domain. Validate server-side against an allow-list and reject private / loopback / link-local address ranges at the HTTP client level.

   OWASP LLM07NIST MANAGE-2.2ATLAS T0051CAST-02
2. highsecret exposuref-r10-generate_geo_page

   Tool `generate_geo_page` exposes secrets or credentials to the agent

   `generate_geo_page` appears to read or return secrets, API keys, credentials, or environment variables (Generate a local SEO-optimized landing page for lead generation. Creates a complete website optimized for a specific city/service combination. Requires authentication via API key (Bearer token). Generate an API key at webzum.com/dashboard/account-settings. This is an ADVANCED tool for creating geo-targeted landing pages with: - Local SEO optimization for city + niche - Lead capture forms with webhook integration - Call tracking support (CallRail, WhatConverts, etc.) - Analytics integration (GA4, GTM) Use this when you have pre-researched business data and want to create location-specific landing pages for lead generation campaigns. The site generation happens in the background. Use get_site_status to check progress.). Values surfaced in the model context are visible to any prompt with injection access; a compromised agent can relay them to an attacker-controlled server.

   fix: Do not expose secrets to the agent: inject them server-side at call time rather than passing them through the model context. If a tool must return a credential, scope it with a capframe-bind time-limited caveat and log every issuance.

   OWASP LLM06NIST MANAGE-2.2ATLAS T0040CAST-01
3. mediumunconstrained inputf-r1-generate_geo_page

   Tool `generate_geo_page` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `aiPromptPrefix`, `brandName`, `city`, `email`, `googleAnalyticsId`, `googleTagManagerId`, `niche`, `phone`, `primaryColor`, `state`, `targetAudience`, `webhookUrl`, `whatsapp`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03