Text-to-SQL chain or SQL agent runs model-written queries
Rule ID: vetkit.llm-app.text-to-sql-chain
A text-to-SQL chain or SQL agent executes the queries the model writes against the connected database. The model can be steered (by the user or by prompt injection in retrieved content) into writing any statement the database user is allowed to run: reading other users' rows, changing data or dropping tables.
Last updated:
Suite: AI code risks
python
A text-to-SQL chain or SQL agent executes the queries the model writes against the connected database. The model can be steered (by the user or by prompt injection in retrieved content) into writing any statement the database user is allowed to run: reading other users' rows, changing data or dropping tables.
Category: LLM SECURITY · Engine rule severity: WARNING
How to fix it
Connect the chain with a dedicated read-only database role that sees only the tables and rows the end user may see (row level security, a statement timeout, a row limit), or replace free-form SQL with a set of parameterised queries the model picks from.
References
Source: packages/engine/rules/llm-app/python.yml.
Related checks
- LLM agent code execution tool: Python REPL or shell tool
- Vite define exposes LLM API key in the client bundle
- LLM call without max tokens limit on request input
- LLM-chosen URL fetched by server: SSRF via prompt injection
- LLM output executed as code or shell command
- LLM-chosen file path used to write or delete files
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.