[{"slug":"ZV-2026-0258","server_name":"agentplaybooks.ai","severity":"breaking","title":"agentplaybooks.ai: Field body was removed from use_secret input; consumers still sending it may be rejected or silently ignored.","summary":"[safe] Tool use_secret_write was added. [risky] Description of use_secret changed (38% word delta). [breaking] Field body was removed from use_secret input; consumers still sending it may be rejected or silently ignored. [breaking] Enum value POST removed from method on use_secret. [breaking] Enum value PUT removed from method on use_secret. [breaking] Enum value PATCH removed from method on use_secret. [breaking] Enum value DELETE removed from method on use_secret. [risky] Enum value HEAD added to method on use_secret.","changes":[{"kind":"tool_added","tool":"use_secret_write","detail":"Tool `use_secret_write` was added.","severity":"safe"},{"kind":"description_changed","tool":"use_secret","after":"Send a GET or HEAD request with a secret injected as a header, and return the response. The secret value is never returned to the agent — it is decrypted and used server-side only. Reads the remote API; it cannot change anything there, because only safe methods are accepted. The URL is chosen by the caller, so the target is whichever API the secret belongs to — see that API's own documentation for paths. Requires secrets:read or full permission. Example: use_secret({secret_name: 'OPENAI_API_KEY', url: 'https://api.openai.com/v1/models'}) sends GET with 'Authorization: Bearer <key>'. Use list_secrets to discover names, use_secret_write to send POST/PUT/PATCH/DELETE, and store_secret or rotate_secret to change a stored value. Pass playbook_id as the UUID or GUID of the playbook this call should target.","before":"Make an outbound HTTP request with a secret injected as a header. The secret value is never returned to the agent — it is decrypted and used server-side only. Side effects match the HTTP method (GET is typically safe; POST/PUT/PATCH/DELETE mutate the remote API). Requires secrets:read or full permission. Example: use_secret({secret_name: 'OPENAI_API_KEY', url: 'https://api.openai.com/v1/models'}) sends GET with 'Authorization: Bearer <key>'. Use list_secrets to discover names. Do not use store_secret or rotate_secret to make the request. Pass playbook_id as the UUID or GUID of the playbook this call should target.","detail":"Description of `use_secret` changed (38% word delta).","severity":"risky","descriptionDelta":0.375},{"kind":"input_property_removed","path":"inputSchema.properties.body","tool":"use_secret","before":{"type":"object","description":"JSON request body (for POST/PUT/PATCH)"},"detail":"Field `body` was removed from `use_secret` input; consumers still sending it may be rejected or silently ignored.","severity":"breaking"},{"kind":"enum_value_removed","path":"inputSchema.properties.method","tool":"use_secret","before":"POST","detail":"Enum value `POST` removed from `method` on `use_secret`.","severity":"breaking"},{"kind":"enum_value_removed","path":"inputSchema.properties.method","tool":"use_secret","before":"PUT","detail":"Enum value `PUT` removed from `method` on `use_secret`.","severity":"breaking"},{"kind":"enum_value_removed","path":"inputSchema.properties.method","tool":"use_secret","before":"PATCH","detail":"Enum value `PATCH` removed from `method` on `use_secret`.","severity":"breaking"},{"kind":"enum_value_removed","path":"inputSchema.properties.method","tool":"use_secret","before":"DELETE","detail":"Enum value `DELETE` removed from `method` on `use_secret`.","severity":"breaking"},{"kind":"enum_value_added","path":"inputSchema.properties.method","tool":"use_secret","after":"HEAD","detail":"Enum value `HEAD` added to `method` on `use_secret`.","severity":"risky"}],"published_at":"2026-08-21T08:35:54.355Z"}]