Tool-invoking agent without input guardrail
ID |
tool-invoking-agent-without-input-guardrail |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
OWASP LLM |
LLM01:2025 — Prompt Injection |
Family |
LLM01 — Prompt Injection |
Asset kind |
ai_agent |
Red-team vectors |
Prompt Injection, Jailbreaks, Indirect Injection |
Tags |
ai_security |
Description
An agent that advertises tools to the model but has no input guardrail lets a hostile prompt drive those tools before any check runs. The inventory records the asymmetry — a non-empty tools[] and an empty input-guardrail coverage — but does not flag it; this detector does.
The rule runs in the post-scan phase over the scan-scoped asset graph: for each ai_agent with at least one USES_TOOL edge and no guardrail covering the input side (position input or both), it raises one finding. The agent is the primary asset and the wired tools are recorded as related assets.
Examples
from langchain.agents import initialize_agent, Tool
tools = [Tool(name="search", func=search, description="Web search")]
agent = initialize_agent(tools, llm, agent="zero-shot-react-description") # no input guardrailWrapping the agent with an input guardrail (NeMo LLMRails(config), llm_guard.scan_prompt(…) before the call, or any ai_guardrail with position=input) clears the finding.