HIGH: /api/tools/:name bypasses confirmation flow — direct tool execution

[rz1989s]

Description

POST /api/tools/:name accepts any tool name and passes arbitrary body input directly to executeTool(). Any authenticated user can call fund-moving tools (deposit, send, refund, sweep) directly, completely bypassing the confirmation flow that /api/command enforces.

The wallet from JWT is not injected into tool params.

File

packages/agent/src/index.ts:189-200

Fix

Either:

1. Remove this endpoint entirely (force tool execution through chat/command flow)
2. Or add wallet injection + dangerous tool blocklist + confirmation requirement

Priority

HIGH — confirmation flow bypass

[rz1989s]

Fixed in PR #70 (merged to main).