Unlimited Agent

Tool annotations match behaviour

4 read-only tools perform write/delete/exec — search_files (line 132: spawn(command, args, {); screenshot (line 132: spawn(command, args, {); list_windows (line 132: spawn(command, args, {)

Either remove the readOnlyHint:true annotation, or remove the write/delete call from the tool handler.

Destructive tools are labelled

1 tool perform destructive updates without destructiveHint — screenshot deletes at line 639 (fs.rm(outputPath, { force: true }))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Descriptions match behaviour

2 tools describe read intent but their handlers mutate — search_files (line 132: spawn(command, args, {); list_windows (line 132: spawn(command, args, {)

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

20/21 tool handlers declare input schemas (95%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Shell command execution

6 child_process/subprocess calls in production code — runs shell commands (server.mjs:132, server.mjs:735, server.mjs:764)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Tool description accuracy

3 tools have description/behavior mismatches: search_files: description implies read-only but handler writes/deletes/executes; screenshot: description implies read-only but handler writes/deletes/executes; list_windows: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.