insecure-output-handling

From README

Insecure Output Handling Security Check (OWASP LLM02:2025) What this checks Protects against XSS, command injection, and second-order injection that arise when LLM output is treated as trusted. The model may produce malicious content through prompt injection or hallucination; downstream systems must sanitize it the same way they would sanitize raw user input. Vulnerable patterns LLM response assigned to a raw-HTML sink (innerHTML, dangerouslySetInnerHTML, v-html, server-side marksafe) without sanitization LLM-generated code or shell string passed to eval, exec, or a subprocess call with shell expansion enabled LLM output interpolated into a SQL or NoSQL query string instead of bound as a parameter LLM-produced markdown rendered to HTML without an allowlist-based sanitizer LLM response forwarded to a downstream API or webhook without re-validating against the destination's schema Fix immediately Flag the vulnerable code and explain the risk.