Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The documented DELETE endpoint takes a directly user-influenceable listing_id and is presented as part of a normal update flow without strong validation or authorization guidance. In a tool-using agent, this creates a high-risk pathway for parameter abuse where a malicious or mistaken prompt could trigger deletion of the wrong marketplace listing or a production listing that cannot be restored if the follow-up POST fails.
- Content
md - The endpoint accepts `image_data` as base64-encoded JPG/PNG up to 10 MB. - A valid minimal image payload can work in production, but some production `image_data` uploads may return a `500 Error` due to backend issues. - No dedicated update endpoint was found for existing marketplace listings. In practice, the flow is: 1. `DELETE /marketplace_listings?id={listing_id}&is_production=1` to remove the old listing. 2. `POST /marketplace_advertise/` to recreate the listing with `image_data`. - `GET /marketplace_listings?id={listing_id}&is_production=1` returns `false` if the listing does not exist. - `GET /marketplace_listings` also supports search by `id_item`, `id_star_system`, `operation`, etc.