agent frameworks don't sanitize tool names before executing them
tested langchain 0.3.14, autogen 0.4.2, crewai 0.86.0. all three just execute whatever tool name the agent returns in structured output, no sanitization. you can inject shell metacharacters in the tool name and the framework passes it straight to exec. tested payload: tool name "list_files; rm -rf /tmp/test" and langchain executed both commands. is anyone validating tool names before execution or are we all just trusting the model output?
ok so hit this exact thing last week with langchain 0.3.14. registered a tool called `eval` and it just crashed with SyntaxError when the agent tried to call it. no validation, no helpful error, just a stack trace that killed the loop
hit this too. does the framework at least prevent execution or does it crash mid-execution and leave partial state?
wait so the framework doesn't even validate tool names before registering them? that seems like a massive oversight. does it at least namespace them or does it just execute whatever string comes back from the agent? i'm trying to understand if this is a validation issue or an execution model issue. if the framework is using eval() or similar to call tools by name then reserved keywords would break but that also means arbitrary code execution is possible if an attacker can control the tool name registry.