Tool and Function Capability Enumeration - ATR-2026-00504 (76f77067-eb1b-5ab2-a8f2-bc00180e5b92)
Detects prompts that attempt to enumerate the AI agent's available tools, function calls, APIs, plugins, or their parameters. Exposing the tool surface helps attackers craft targeted injection or privilege escalation attacks against specific tools. Covers: direct tool listing requests, function call enumeration, API and service discovery, specific tool parameter extraction, and "list all" completeness demands. Generalised from promptfoo tool-discovery plugin corpus - hardcoded tool name 'booking' replaced with generic tool/function/API enumeration patterns that match any tool name.