insecure-plugin-design

From README

Insecure Plugin Design (OWASP LLM07:2025) What this checks Prevents LLM tools and plugins from being abused via malicious or malformed inputs driven by prompt injection or jailbreaks. Unvalidated tool parameters let an attacker escalate from a chat window to arbitrary file access, command execution, or data exfiltration. Vulnerable patterns Tool handler accepts an unconstrained string parameter (path, URL, query) with no allowlist, regex, or length cap Tool schema declares parameters with no enum, maxLength, pattern, or additionalProperties: false constraints Authorization decision delegated to the LLM rather than enforced inside the tool handler against the invoking principal Single tool multiplexes read, write, and delete behind an action parameter instead of separate handlers Tool invocation produces no audit record naming the principal, tool, and sanitized arguments Fix immediately Flag the vulnerable code and explain the risk.