api.vaultcrux.com

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

declare_constraint lets the calling agent immediately create 'boundary/relationship/policy/context_flag' constraints that other tools (check_constraints, verify_before_acting) treat as authoritative and use to allow/block future actions. Unlike suggest_constraint, which the platform explicitly describes as low-barrier because 'authority gate is on promotion, not suggestion' (i.e. a human must approve), declare_constraint has no described human-approval step. A prompt-injected or manipulated agent could use this tool to plant a false policy (e.g. 'sharing customer data with vendor X is approved') that silently steers subsequent agent/human decisions.

Though documented as 'human-only', the tool is exposed in the agent's toolset and accepts an arbitrary base_url plus a plaintext credential_value and a custom auth_injection template. If an agent is manipulated into calling this (e.g. via injected instructions), it could register an attacker-controlled endpoint, after which request_credentialed_call would inject stored credentials into calls to that endpoint — a classic exfiltration/SSRF pattern. Nothing in the schema itself enforces the 'human-only' restriction.

Combined with register_external_service, this tool lets an agent send arbitrary payloads/headers to any registered service while the server injects stored credentials. If a malicious or spoofed service was registered (or a legitimate service's base_url could be altered), sensitive request data and authenticated access could be routed to an external destination outside user visibility.

fill_gap explicitly writes new 'knowledge' content into a gap that was reported by a different tenant, crediting cross-tenant contributions. This creates a mechanism for one tenant's agent to inject content into another tenant's knowledge base, which is a potential vector for cross-tenant data poisoning or misinformation if the gap-reporting/fill relationship isn't tightly validated.

This privileged tool adds or supersedes tuples describing an agent's expected behavior/sufficiency thresholds used by drift-detection (assess_character_drift). Despite being labeled as requiring 'operator-class API credentials... required by the API', it is exposed as a normal callable tool to the agent. If reachable by a manipulated agent, it could be used to redefine what 'expected' agent behavior looks like, undermining the drift-detection safety mechanism it is meant to support.