Stoa Agent Risk Report — support-desk

At a glance

Agent candidates

High-exposure candidates

Critical findings

Suppressed findings

Files scanned

Findings by severity

31327

CriticalHighMediumLowInfo

Agent risk map

Each candidate, ranked by static exposure: high-impact capabilities, sensitive integrations, and finding severity. Static evidence does not prove runtime reachability.

account_agent

crew

billing_agent

billing_executor

escalation_agent

research_agent

support_widget

triage_agent

workflow

SevereElevatedModerateLow

Static exposure combines high-impact capabilities, sensitive integrations, and finding severity per candidate. Higher means more to review first, not a proven exploit.

Expand any candidate below for the evidence, capabilities, integrations, and findings.

account_agentSevere exposure

agents/account_agent.py · High confidence

1 critical3 info

database_write
email_send

Details & evidence

Detected because

CrewAI agent construct at line 17
Agent execution or orchestration call at line 27

Detection score: 8 · symbol: account_agent

Stack

Frameworks: crewai · Providers: —

Capabilities (static evidence)

database_write
email_send

Integrations · call sites

sendgrid × 4

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
critical	`SEC002`	15	Possible hardcoded password `DB_PASSWORD = "Sup3rS3cretPr0d!2026"` Load the password from a secret manager or environment variable.
info	`CTRL001`	17	Authentication control not observed `Authentication control not observed for candidate account_agent` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	17	Input validation control not observed `Input validation control not observed for candidate account_agent` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	17	Rate limiting control not observed `Rate limiting control not observed for candidate account_agent` Confirm rate limiting exists for this agent's actions; it was not observed in this file.

crewSevere exposure

agents/account_agent.py · High confidence

1 critical3 info

database_write
email_send

Details & evidence

Detected because

CrewAI agent construct at line 17
Agent execution or orchestration call at line 27

Detection score: 8 · symbol: crew

Stack

Frameworks: crewai · Providers: —

Capabilities (static evidence)

database_write
email_send

Integrations · call sites

sendgrid × 4

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
critical	`SEC002`	15	Possible hardcoded password `DB_PASSWORD = "Sup3rS3cretPr0d!2026"` Load the password from a secret manager or environment variable.
info	`CTRL001`	17	Authentication control not observed `Authentication control not observed for candidate crew` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	17	Input validation control not observed `Input validation control not observed for candidate crew` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	17	Rate limiting control not observed `Rate limiting control not observed for candidate crew` Confirm rate limiting exists for this agent's actions; it was not observed in this file.

billing_agentSevere exposure

agents/billing_agent.py · High confidence

1 critical1 high1 medium3 info

payment_access
+3 more

Details & evidence

Detected because

LangChain agent construct at line 27
Tool or function schema at line 22
LLM provider import or reference at line 20

Detection score: 8 · symbol: billing_agent

Stack

Frameworks: langchain · Providers: openai

Capabilities (static evidence)

database_read
external_http
payment_access
tool_calling

Integrations · call sites

postgres × 2
stripe × 2

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
critical	`SEC001`	16	Possible hardcoded API credential `OPENAI_FALLBACK_KEY = "sk-pro…[REDACTED:2f5a2a55d8ba]"` Load the credential from a secret manager or environment variable.
info	`CTRL001`	27	Authentication control not observed `Authentication control not observed for candidate billing_agent` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	27	Input validation control not observed `Input validation control not observed for candidate billing_agent` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	27	Rate limiting control not observed `Rate limiting control not observed for candidate billing_agent` Confirm rate limiting exists for this agent's actions; it was not observed in this file.
high	`SEC003`	38	Interpolated SQL statement `cursor.execute(f"SELECT id, total_cents FROM invoices WHERE customer_id = {customer_id}")` Use parameterized queries instead of string interpolation.
medium	`NET002`	43	Request timeout not observed `requests.post("https://ledger.corp-internal.example-desk.io/api/v1/sync", json=payload)` Pass an explicit timeout so a hung upstream cannot stall the agent.

billing_executorSevere exposure

agents/billing_agent.py · High confidence

1 critical1 high1 medium3 info

payment_access
+3 more

Details & evidence

Detected because

LangChain agent construct at line 27
Tool or function schema at line 22
LLM provider import or reference at line 20

Detection score: 8 · symbol: billing_executor

Stack

Frameworks: langchain · Providers: openai

Capabilities (static evidence)

database_read
external_http
payment_access
tool_calling

Integrations · call sites

postgres × 2
stripe × 2

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
critical	`SEC001`	16	Possible hardcoded API credential `OPENAI_FALLBACK_KEY = "sk-pro…[REDACTED:2f5a2a55d8ba]"` Load the credential from a secret manager or environment variable.
info	`CTRL001`	27	Authentication control not observed `Authentication control not observed for candidate billing_executor` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	27	Input validation control not observed `Input validation control not observed for candidate billing_executor` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	27	Rate limiting control not observed `Rate limiting control not observed for candidate billing_executor` Confirm rate limiting exists for this agent's actions; it was not observed in this file.
high	`SEC003`	38	Interpolated SQL statement `cursor.execute(f"SELECT id, total_cents FROM invoices WHERE customer_id = {customer_id}")` Use parameterized queries instead of string interpolation.
medium	`NET002`	43	Request timeout not observed `requests.post("https://ledger.corp-internal.example-desk.io/api/v1/sync", json=payload)` Pass an explicit timeout so a hung upstream cannot stall the agent.

escalation_agentElevated exposure

agents/escalation_agent.py · Medium confidence

1 medium3 info

messaging
+3 more

Details & evidence

Detected because

LLM provider invocation at line 20
Tool or function schema at line 13
LLM provider import or reference at line 9

Detection score: 5 · symbol: escalation_agent

Stack

Frameworks: — · Providers: anthropic

Capabilities (static evidence)

customer_support
external_http
messaging
tool_calling

Integrations · call sites

slack × 1
zendesk × 3

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
info	`CTRL001`	20	Authentication control not observed `Authentication control not observed for candidate escalation_agent` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	20	Input validation control not observed `Input validation control not observed for candidate escalation_agent` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	20	Rate limiting control not observed `Rate limiting control not observed for candidate escalation_agent` Confirm rate limiting exists for this agent's actions; it was not observed in this file.
medium	`REL001`	44	Swallowed exception `except Exception:` Handle or log the exception instead of silently discarding it.

research_agentModerate exposure

agents/research_agent.py · High confidence

1 medium3 info

+2 more

Details & evidence

Detected because

OpenAI Agents SDK agent construct at line 9
Agent execution or orchestration call at line 21

Detection score: 8 · symbol: research_agent

Stack

Frameworks: openai_agents_sdk · Providers: —

Capabilities (static evidence)

external_http
web_search

Integrations · call sites

None observed.

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
info	`CTRL001`	9	Authentication control not observed `Authentication control not observed for candidate research_agent` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	9	Input validation control not observed `Input validation control not observed for candidate research_agent` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	9	Rate limiting control not observed `Rate limiting control not observed for candidate research_agent` Confirm rate limiting exists for this agent's actions; it was not observed in this file.
medium	`NET001`	31	Insecure non-local HTTP endpoint `"http://legacy-kb.corp-intranet-desk.com/search",` Use HTTPS for non-local endpoints.

support_widgetModerate exposure

web/support_widget.ts · Medium confidence

3 info

zendesk
+3 more

Details & evidence

Detected because

LLM provider invocation at line 13
Tool or function schema at line 7
LLM provider import or reference at line 3

Detection score: 5 · symbol: support_widget

Stack

Frameworks: — · Providers: openai

Capabilities (static evidence)

customer_support
external_http
tool_calling

Integrations · call sites

zendesk × 1

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
info	`CTRL001`	13	Authentication control not observed `Authentication control not observed for candidate support_widget` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	13	Input validation control not observed `Input validation control not observed for candidate support_widget` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	13	Rate limiting control not observed `Rate limiting control not observed for candidate support_widget` Confirm rate limiting exists for this agent's actions; it was not observed in this file.

triage_agentLow exposure

agents/triage_agent.py · Medium confidence

3 info

Details & evidence

Detected because

PydanticAI agent construct at line 3

Detection score: 5 · symbol: triage_agent

Stack

Frameworks: pydantic_ai · Providers: —

Capabilities (static evidence)

None observed.

Integrations · call sites

None observed.

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
info	`CTRL001`	3	Authentication control not observed `Authentication control not observed for candidate triage_agent` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	3	Input validation control not observed `Input validation control not observed for candidate triage_agent` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	3	Rate limiting control not observed `Rate limiting control not observed for candidate triage_agent` Confirm rate limiting exists for this agent's actions; it was not observed in this file.

workflowLow exposure

orchestrator.py · Medium confidence

3 info

Details & evidence

Detected because

LangGraph agent construct at line 37
LLM provider import or reference at line 14

Detection score: 6 · symbol: workflow

Stack

Frameworks: langgraph · Providers: openai

Capabilities (static evidence)

None observed.

Integrations · call sites

None observed.

Attribution

Last touched by: unknown

Findings in this file

Severity	Rule	Line	Finding
info	`CTRL001`	37	Authentication control not observed `Authentication control not observed for candidate workflow` Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	37	Input validation control not observed `Input validation control not observed for candidate workflow` Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	37	Rate limiting control not observed `Rate limiting control not observed for candidate workflow` Confirm rate limiting exists for this agent's actions; it was not observed in this file.

All findings

Everything the scan found, grouped. Sections are collapsed so the report leads with the map; nothing is omitted.

Security findings (4)

Severity	Rule	Location	Confidence	Finding	Remediation
critical	`SEC002`	`agents/account_agent.py:15`	High	Possible hardcoded password `DB_PASSWORD = "Sup3rS3cretPr0d!2026"`	Load the password from a secret manager or environment variable.
critical	`SEC001`	`agents/billing_agent.py:16`	High	Possible hardcoded API credential `OPENAI_FALLBACK_KEY = "sk-pro…[REDACTED:2f5a2a55d8ba]"`	Load the credential from a secret manager or environment variable.
critical	`SEC001`	`tests/test_billing.py:3`	Low	Possible hardcoded API credential `FAKE_STRIPE_STYLE_KEY = "sk-pro…[REDACTED:654c43ce84ef]"`	Load the credential from a secret manager or environment variable.
high	`SEC003`	`agents/billing_agent.py:38`	Medium	Interpolated SQL statement `cursor.execute(f"SELECT id, total_cents FROM invoices WHERE customer_id = {customer_id}")`	Use parameterized queries instead of string interpolation.

Reliability findings (3)

Severity	Rule	Location	Confidence	Finding	Remediation
medium	`NET002`	`agents/billing_agent.py:43`	Low	Request timeout not observed `requests.post("https://ledger.corp-internal.example-desk.io/api/v1/sync", json=payload)`	Pass an explicit timeout so a hung upstream cannot stall the agent.
medium	`REL001`	`agents/escalation_agent.py:44`	High	Swallowed exception `except Exception:`	Handle or log the exception instead of silently discarding it.
medium	`NET001`	`agents/research_agent.py:31`	Medium	Insecure non-local HTTP endpoint `"http://legacy-kb.corp-intranet-desk.com/search",`	Use HTTPS for non-local endpoints.

Review prompts (27)

Review prompts are observations, not confirmed vulnerabilities: a control was not observed in the scanned file, but may exist elsewhere.

Severity	Rule	Location	Confidence	Finding	Remediation
info	`CTRL001`	`agents/account_agent.py:17`	Low	Authentication control not observed `Authentication control not observed for candidate crew`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL001`	`agents/account_agent.py:17`	Low	Authentication control not observed `Authentication control not observed for candidate account_agent`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	`agents/account_agent.py:17`	Low	Input validation control not observed `Input validation control not observed for candidate account_agent`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL002`	`agents/account_agent.py:17`	Low	Input validation control not observed `Input validation control not observed for candidate crew`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	`agents/account_agent.py:17`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate crew`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.
info	`CTRL003`	`agents/account_agent.py:17`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate account_agent`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.
info	`CTRL001`	`agents/billing_agent.py:27`	Low	Authentication control not observed `Authentication control not observed for candidate billing_executor`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL001`	`agents/billing_agent.py:27`	Low	Authentication control not observed `Authentication control not observed for candidate billing_agent`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	`agents/billing_agent.py:27`	Low	Input validation control not observed `Input validation control not observed for candidate billing_executor`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL002`	`agents/billing_agent.py:27`	Low	Input validation control not observed `Input validation control not observed for candidate billing_agent`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	`agents/billing_agent.py:27`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate billing_executor`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.
info	`CTRL003`	`agents/billing_agent.py:27`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate billing_agent`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.
info	`CTRL001`	`agents/escalation_agent.py:20`	Low	Authentication control not observed `Authentication control not observed for candidate escalation_agent`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	`agents/escalation_agent.py:20`	Low	Input validation control not observed `Input validation control not observed for candidate escalation_agent`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	`agents/escalation_agent.py:20`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate escalation_agent`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.
info	`CTRL001`	`agents/research_agent.py:9`	Low	Authentication control not observed `Authentication control not observed for candidate research_agent`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	`agents/research_agent.py:9`	Low	Input validation control not observed `Input validation control not observed for candidate research_agent`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	`agents/research_agent.py:9`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate research_agent`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.
info	`CTRL001`	`agents/triage_agent.py:3`	Low	Authentication control not observed `Authentication control not observed for candidate triage_agent`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	`agents/triage_agent.py:3`	Low	Input validation control not observed `Input validation control not observed for candidate triage_agent`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	`agents/triage_agent.py:3`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate triage_agent`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.
info	`CTRL001`	`orchestrator.py:37`	Low	Authentication control not observed `Authentication control not observed for candidate workflow`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	`orchestrator.py:37`	Low	Input validation control not observed `Input validation control not observed for candidate workflow`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	`orchestrator.py:37`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate workflow`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.
info	`CTRL001`	`web/support_widget.ts:13`	Low	Authentication control not observed `Authentication control not observed for candidate support_widget`	Confirm authentication is enforced before this agent acts; it was not observed in this file.
info	`CTRL002`	`web/support_widget.ts:13`	Low	Input validation control not observed `Input validation control not observed for candidate support_widget`	Confirm inputs are validated before this agent acts; validation was not observed in this file.
info	`CTRL003`	`web/support_widget.ts:13`	Low	Rate limiting control not observed `Rate limiting control not observed for candidate support_widget`	Confirm rate limiting exists for this agent's actions; it was not observed in this file.

Suppressed findings (1)

Rule	Location	Finding	Reason
`SEC003`	`tools/database.py:40`	Interpolated SQL statement	table name comes from the REPORT_TABLES enum above