vetkit.llm-app.tool-args-command-execution
An LLM tool (function calling / MCP tool) passes arguments chosen by the model straight to a shell, to code evaluation or to raw SQL without an allow-list. Prompt injection in any content the agent reads can steer the model into calling the tool with an arbitrary command or query.
Last updated:
Suite: AI code risks
javascript, typescript
An LLM tool (function calling / MCP tool) passes arguments chosen by the model straight to a shell, to code evaluation or to raw SQL without an allow-list. Prompt injection in any content the agent reads can steer the model into calling the tool with an arbitrary command or query.
Category: LLM SECURITY · Engine rule severity: ERROR
How to fix it
Give the tool narrow, typed parameters and map them to an allow-list of commands or pre-written, parameterised queries. Where free-form execution is the point of the tool, run it in a sandbox without secrets and require human confirmation before it runs.
References
Source: packages/engine/rules/llm-app/javascript.yml.
python
An LLM tool (function calling / MCP tool) passes arguments chosen by the model straight to a shell, to code evaluation or to raw SQL without an allow-list. Prompt injection in any content the agent reads can steer the model into calling the tool with an arbitrary command or query.
Category: LLM SECURITY · Engine rule severity: ERROR
How to fix it
Give the tool narrow, typed parameters and map them to an allow-list of commands or pre-written, parameterised queries. Where free-form execution is the point of the tool, run it in a sandbox without secrets and require human confirmation before it runs.
References
Source: packages/engine/rules/llm-app/python.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.