---
id: owasp-asi02-tool-misuse
track: coding
version: 0.0.2
label: advisory
keyword: advise
where: text
sha256: 5bb3ab255d9a8a2da6225ceb7af5c38340ccbf33113c5449a77ac7f5ccdbc465
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi02-tool-misuse
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# OWASP ASI02 — Tool Misuse & Exploitation

owasp-asi02-tool-misuse · version 0.0.2

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Constrain what an agent's legitimate tools can be made to do. Grant least agency per task, validate tool parameters at the runtime boundary, authorise every invocation rather than only the first, and distrust tool metadata from unverified registries. Use when defining tool schemas, wiring an MCP server, granting shell or cloud-CLI access, or reviewing a tool-calling loop. Do NOT use for the credentials the tool authenticates with — that is \`owasp-asi03-identity-privilege-abuse\`.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=owasp-asi02-tool-misuse
- Cursor (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=cursor&p=owasp-asi02-tool-misuse
- Codex (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=codex&p=owasp-asi02-tool-misuse
- GitHub Copilot (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=copilot&p=owasp-asi02-tool-misuse
- Devin (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=devin&p=owasp-asi02-tool-misuse
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=owasp-asi02-tool-misuse
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=owasp-asi02-tool-misuse
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=owasp-asi02-tool-misuse
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=owasp-asi02-tool-misuse
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=owasp-asi02-tool-misuse
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=owasp-asi02-tool-misuse

## What it misses

This policy does not state what it misses.

## Latest change

0.0.2 · 2026-09-29 — Point at the mechanised slice: the agentic-code-security gate's tools|approval pack refuses a tool whose str parameter reaches a subprocess, generic shell tools, and approvals switched off, at commit and at tool use. Everything else here stays advisory, and no rule text or claim is raised; the pointer is a see() and a references section.

## Provenance

- Tested by 0 of 6 cases run automatically
- SHA-256: `5bb3ab255d9a8a2da6225ceb7af5c38340ccbf33113c5449a77ac7f5ccdbc465`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi02-tool-misuse (catalog path `agentic-security/owasp-asi02-tool-misuse`)
- Presets: OWASP agentic top 10
- JSON: `/api/coding/policies/owasp-asi02-tool-misuse.json`
- Report a problem: https://chock.sh/report/?policy=owasp-asi02-tool-misuse&version=0.0.2&page=%2Fcoding%2Fpolicies%2Fowasp-asi02-tool-misuse%2F