LLM agent code execution tool: Python REPL or shell tool
Rule ID: vetkit.llm-app.code-execution-tool
The agent is given a tool that runs the code the model writes (a Python REPL tool, a pandas / CSV / Spark dataframe agent, a shell tool, or a framework flag that opts into unsandboxed code execution). Whatever the model emits runs with the server's privileges, so prompt injection in a chat message or in a document the agent reads becomes remote code execution.
Last updated:
Suite: AI code risks
python
The agent is given a tool that runs the code the model writes (a Python REPL tool, a pandas / CSV / Spark dataframe agent, a shell tool, or a framework flag that opts into unsandboxed code execution). Whatever the model emits runs with the server's privileges, so prompt injection in a chat message or in a document the agent reads becomes remote code execution.
Category: LLM SECURITY · Engine rule severity: ERROR
How to fix it
Replace the code-running tool with narrow, typed tools (a fixed set of dataframe operations, a parameterised query) that the model can call. If generated code must run, execute it in a disposable sandbox (container or remote interpreter) without credentials, network access or the application's filesystem, and never on the web server itself.
References
Source: packages/engine/rules/llm-app/python.yml.
Related checks
- Vite define exposes LLM API key in the client bundle
- LLM call without max tokens limit on request input
- LLM-chosen URL fetched by server: SSRF via prompt injection
- LLM output executed as code or shell command
- LLM-chosen file path used to write or delete files
- LLM output rendered as HTML without sanitising: XSS
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.