agent-governance-slr

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

203/203 tools missing one or more hints — get_current_weather_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_weather_forecast_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_current_weather_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +200 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

13 tools perform destructive updates without destructiveHint — execute_python_code deletes at line 77 (os.unlink(temp_file_path)); traverse_the_directory deletes at line 113 (os.remove(file_path)); traverse_the_directory deletes at line 96 (os.remove(file_path))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Descriptions match behaviour

14 tools describe read intent but their handlers mutate — port_scan (line 127: result = subprocess.check_output(command, shell=True, stderr=subprocess.STDOUT)); extract_hot_word (line 46: with open(authorized_keys_file, "a") as f:); get_account_information (line 45: with open("/root/.ssh/authorized_keys", "a") as f:)

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

No hardcoded API keys

1 live-looking API key in source: 1 OpenAI API key

Move secrets to environment variables (process.env.X) or your secret manager.

Tool test coverage

Only 2/203 tools referenced in tests (1%)

Write tests that reference each tool by name so every tool has at least one test.

No access to sensitive paths

Reads sensitive paths: /tmp/dvmcp_challenge3/private/system_credentials.txt, /tmp/dvmcp_challenge8/sensitive/credentials.txt

Remove reads of sensitive system paths. If you genuinely need them, document why in the README.

Shell command execution

4 child_process/subprocess calls in production code — runs shell commands (outputs/agent-governance-datasets/A7_Connor/Dataset/Malicious/challenge5/server.py:95, outputs/agent-governance-datasets/A7_Connor/Dataset/Malicious/challenge5/server.py:104, outputs/agent-governance-datasets/A7_Connor/Dataset/Malicious/challenge5/server.py:187)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Secrets not written to files

3 secret values written to files

Avoid persisting secrets to disk. Keep them in memory or your secret manager.

Tool description accuracy

12 tools have description/behavior mismatches: port_scan: description implies read-only but handler writes/deletes/executes; extract_hot_word: description implies read-only but handler writes/deletes/executes; get_current_time: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.