During authorized testing, a Fire/EMS assistant's tool calls appear influenced by injected natural-language 'parameters' in the chat. Which risk class should be recorded?

If a Fire/EMS assistant's tool calls appear influenced by injected natural-language 'parameters' in chat during authorized testing, the risk class is prompt-driven tool-parameter manipulation affecting agent tool use. Free-form language mapped into tool arguments creates a channel where adversarial text can alter lookups, destinations, filters, or actions the agent executes. For EMS-adjacent civic agents, that class is high priority because tool misuse can affect operational data retrieval and downstream workflows. Model hallucination producing inaccurate dispatch guidance is a generation reliability issue, not a case of natural-language text steering tool arguments. Training data poisoning shaping baseline emergency model behavior is a model-development issue, not a risk class for this finding—the stem is asking what happened to the tool call, not how the model was trained. System prompt disclosure revealing developer instructions is a confidentiality issue with the agent's instructions, unrelated to whether chat text is being mapped into tool parameters. Exam caveat: record the risk as tool-parameter manipulation and impact potential; do not treat the finding as a license to publish live exploit strings that force harmful real-world tool calls. Operational check: schema-validate and allow-list tool arguments, separate user text from parameter binding, require confirmation for sensitive tools, log argument sources, and retest with injected parameter-style phrases against Fire/EMS assistant tools in a sandbox.