Indirect-injection sink without input guardrail

ID

indirect-injection-sink-without-guardrail

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM01:2025 — Prompt Injection

Family

LLM01 — Prompt Injection

Asset kind

ai_agent

Red-team vectors

Indirect Injection, Prompt Injection

Tags

ai_security

Description

Prompt injection does not only arrive through the user turn. When an agent ingests content from an untrusted external channel — a network / HTTP-fetch tool, a RAG vector store, or an email / chat parser — attacker text can ride in through fetched or retrieved content. Without an input guardrail on that ingestion path, the content reaches the model unchecked: the classic indirect-injection sink.

The rule runs in the post-scan phase over the scan-scoped asset graph: for each ai_agent wired to a network-side-effect tool, a READS_VECTOR_STORE edge, or an INGESTS_EXTERNAL edge, and with no input-side guardrail, it raises one finding.

Examples

from langchain.agents import initialize_agent
from langchain_community.tools import WebBrowserTool

tools = [WebBrowserTool()]                 # fetched web content is an injection channel
agent = initialize_agent(tools, llm)       # no input guardrail

An agent connected to a vector store (Chroma(…​).as_retriever()) without an input guardrail flags the same way. Wiring an input guardrail removes the finding on the next scan.

Mitigation / Fix

  • Add an input guardrail on the ingestion path: sanitize and validate fetched, retrieved, or parsed content before it enters the prompt.

  • Constrain the source: URL/host allowlist for browsing tools, per-tenant filter for retrieval.

  • Treat retrieved / fetched content as untrusted, never as instructions.