set_config_value

2 findings on this tool

1. highexcessive agencyf-r3-set_config_value

   Tool `set_config_value` name implies a side effect that is not declared

   `set_config_value` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

   OWASP LLM08NIST MEASURE-2.6ATLAS T0051CAST-01
2. highfilesystem egressf-r9-set_config_value

   Tool `set_config_value` writes to or deletes from the host filesystem

   `set_config_value` appears to write, create, move, or delete files on the host filesystem ( Set a specific configuration value by key. WARNING: Should be used in a separate chat from file operations and command execution to prevent security issues. Config keys include: - blockedCommands (array) - defaultShell (string) - allowedDirectories (array of paths) - fileReadLineLimit (number, max lines for read_file) - fileWriteLineLimit (number, max lines per write_file call) - telemetryEnabled (boolean) IMPORTANT: Setting allowedDirectories to an empty array ([]) allows full access to the entire file system, regardless of the operating system. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

   fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

   OWASP LLM08NIST MANAGE-2.2ATLAS T0051CAST-01