react-doctor/agent-tool-capability-risk

An AI agent tool that can reach shell, filesystem, or network primitives lets prompt-injected input trigger those actions, because the model treats tool arguments as trusted.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires only in a file whose path is under an agents/, tools/, or mcp/ directory (or whose filename contains agent/tool/mcp) that BOTH defines a tool: tool({, createTool(, defineTool(, or new DynamicTool(/new StructuredTool(: AND, anywhere in the same file (comments stripped first), references a dangerous-capability keyword: exec/execSync/spawn/child_process/eval/new Function/vm.run/readFile/writeFile/fs.read/fs.write/fetch/axios/http.request/sandbox/runCode/executeCode.

Suppress when: the dangerous keyword lives in unrelated code in the same file and is not actually wired into the tool's handler, or the tool already validates/allowlists its arguments and scopes the capability so prompt-injected input cannot reach the primitive. This is a file-level co-occurrence heuristic, not data-flow, so confirm the capability is reachable from tool input.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Treat every tool argument as attacker-controlled. Validate inputs against a strict schema and allowlist commands, paths, and hosts instead of passing free-form strings into exec/spawn/fs/fetch; never use shell: true or build shell commands by concatenation. Scope each capability to the minimum it needs (sandbox, read-only filesystem, egress allowlist), and prefer purpose-built operations over raw shell, filesystem, or network access.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.