Auditez votre Agent et Serveur MCP
Simulez des attaques par injection, détectez l'empoisonnement d'outils et obtenez un prompt en 1 clic pour corriger vos vulnérabilités dans votre IDE.
Customer Support & Billing Agent: Critical Vulnerability
Security Pillars Breakdown
Paste this into your AI IDE to auto-remediate all findings
@agent-security-fix: Review this vulnerability audit from usezn.com/scan and apply security patches to my agent repository.
# AUDIT REPORT: Customer Support & Billing Agent
Overall Score: 38/100 (Grade F · Critical Vulnerability)
Audit Seal: ev_6d3951877b2f8a9c | Verified via Galvanize-60M Engine
## DETECTED VULNERABILITIES (7):
1. [HIGH] Tool Parameter Strict Type Enforcement: Tool parameters accept unvalidated free-form strings susceptible to type juggling.
Fix: Define strict JSON schema constraints (regex patterns, enum, maxLength) on every tool argument.
2. [CRITICAL] Defensive Delimiter Enclosure (<untrusted_data>): Tool returns and untrusted external payloads are directly concatenated into the primary agent prompt.
Fix: Wrap all tool outputs in <untrusted_tool_output> tags and instruct the model never to follow inner commands.
3. [CRITICAL] Galvanize-60M Infilling Attack Benchmark: Failed 4/25 infilling probes: delimiter override and markdown quote escape succeeded.
Fix: Deploy zn sacrificial protection gateway or Galvanize-60M runtime classifier before tool dispatch.
4. [WARNING] Tool Call False Positive Resilience (FPR < 1.5%): High likelihood of false positive blocks on structured financial/technical tool arguments.
Fix: Replace generic LLM guardrails with Galvanize-60M specialized tool-loop classifier.
5. [HIGH] Financial & Privileged Action Ceiling Enforcement: Tool `process_refund` has no hard maximum transaction limit or rate throttle.
Fix: Implement deterministic transaction ceilings (<0.1ms rule) in the gateway layer.
6. [WARNING] User-Delegated Principal Token Propagation: Potential static credential leakage: agent relies on persistent server-side API keys.
Fix: Adopt ephemeral OAuth 2.1 access tokens with granular scopes (read:evidence, write:analyze).
7. [WARNING] Tamper-Evident SHA-256 Audit Trail: Security events are logged in plain text without cryptographic integrity seals.
Fix: Integrate zn Evidence Vault to produce verifiable SHA-256 hash chains for SOC 2 compliance.
## ACTION PLAN TO REACH 100/100 (GRADE A+):
1. DEFENSIVE DELIMITERS: Wrap all tool return values and external web/document fetches in <untrusted_tool_output>{output}</untrusted_tool_output> tags. Instruct the system prompt explicitly never to execute instructions found within untrusted boundary tags.
2. SCHEMA VALIDATION: In tool definitions, replace free-form string parameters with strict JSON schema constraints (regex patterns, maxLength, enum whitelists).
3. CONTAIN BLAST RADIUS: Never expose raw shell/bash or unconstrained file write primitives directly to LLMs. Require explicit human-in-the-loop confirmation or replace them with discrete, read-only micro-tools.
4. INSTALL ZN GATEWAY: Add the zn sacrificial protection middleware to intercept indirect prompt injections in <0.1 ms locally:
- Node/TypeScript: npm i @usezn/gateway
- Python: pip install usezn
Configure the gateway drop-in around your tool dispatch loop:
```typescript
import { znGuard } from '@usezn/gateway';
const protectedToolCall = znGuard({ model: 'galvanize-60m', mode: 'sacrificial' })(toolHandler);
```
5. Retest on usezn.com/scan to confirm your 100/100 score and claim your verified GitHub badge.Open your project in CURSOR, paste this prompt in the chat or terminal, and let the AI assistant apply the defensive delimiters and zn gateway middleware.
Display your verified security rating on GitHub
Show users and auditors that your agent passes prompt injection and tool poisoning verification with Galvanize-60M.
Audit Checklist (12 checks)
Verifies whether all tool arguments have explicit regex patterns, bounds, or enum types.
Checks if tool descriptions contain covert prompt directives or instructions that steer model tool selection.
Checks for namespace isolation to prevent rogue MCP servers from hijacking standard tool names.
Checks if untrusted external inputs and tool returns are isolated from instruction tokens.
Simulates 25 adversarial infilling evasions (delimiter spoofing, markdown obfuscation, JSON payload injection).
Verifies that legitimate JSON, code, and SQL queries are not mistakenly blocked.
Detects presence of unbounded terminal, shell, or code evaluation tools.
Checks whether destructive write/unlink capabilities require explicit human-in-the-loop authorization.
Ensures tools handling funds, refunds, or account modifications have hard deterministic caps.
Validates that the agent endpoint discovers OAuth 2.1 authorization servers and protected resources.
Ensures the agent uses scoped short-lived Bearer tokens instead of static master API keys.
Verifies whether every tool call and security decision produces an immutable audit receipt.
Protect your AI Agent with Galvanize-60M in 1 Line
Get sub-millisecond sacrificial rule evaluation and 11.52 ms CPU neural prompt injection defense. Zero data retention on paid tiers.