get_publishable_keys

2 findings on this tool

1. highsecret exposuref-r10-get_publishable_keys

   Tool `get_publishable_keys` exposes secrets or credentials to the agent

   `get_publishable_keys` appears to read or return secrets, API keys, credentials, or environment variables (Gets all publishable API keys for a project, including legacy anon keys (JWT-based) and modern publishable keys (format: sb_publishable_...). Publishable keys are recommended for new applications due to better security and independent rotation. Legacy anon keys are included for compatibility, as many LLMs are pretrained on them. Disabled keys are indicated by the "disabled" field; only use keys where disabled is false or undefined.). Values surfaced in the model context are visible to any prompt with injection access; a compromised agent can relay them to an attacker-controlled server.

   fix: Do not expose secrets to the agent: inject them server-side at call time rather than passing them through the model context. If a tool must return a credential, scope it with a capframe-bind time-limited caveat and log every issuance.

   OWASP LLM06NIST MANAGE-2.2ATLAS T0040CAST-01
2. mediumunconstrained inputf-r1-get_publishable_keys

   Tool `get_publishable_keys` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `project_id`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03