Skip to content

Content corrections for agentic_tools - #29

Open
afshinlamei wants to merge 1 commit into
OWASP:developmentfrom
afshinlamei:fix/agentic-tools-content
Open

afshinlamei wants to merge 1 commit into
OWASP:developmentfrom
afshinlamei:fix/agentic-tools-content

Conversation

@afshinlamei

Copy link
Copy Markdown

Align the /agentic-tools page and its lab manual section with what the backend does, based on functional testing of the lab.

  • Describe the real flaw: a lookup with no per-user scoping. Quotes are escaped, so SQL injection does not work at any tier.
  • List what each defense tier F0-F4 adds; only F0 leaks through the tools.
  • Correct the solve condition and remove the literal token from the page and the manual hint.
  • Map the lab to LLM05 and LLM06 in both places.
  • Add model notes, where to see generated_sql, hardened-mode scope and a mitigation checklist.
  • Manual: fix description, objective, threat model, tier text and the table row anchor.

Backend and UI issues found during testing are left for a separate issue.

Align the /agentic-tools page and its lab manual section with what the
backend does, based on functional testing of the lab.

- Describe the real flaw: a lookup with no per-user scoping. Quotes are
  escaped, so SQL injection does not work at any tier.
- List what each defense tier F0-F4 adds; only F0 leaks through the tools.
- Correct the solve condition and remove the literal token from the page
  and the manual hint.
- Map the lab to LLM05 and LLM06 in both places.
- Add model notes, where to see generated_sql, hardened-mode scope and a
  mitigation checklist.
- Manual: fix description, objective, threat model, tier text and the
  table row anchor.

Backend and UI issues found during testing are left for a separate issue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@maryammouzarani2024
maryammouzarani2024 changed the base branch from main to development October 16, 2026 14:45

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant