Prompt injection surface detected
HighAV-RUNTIME-002Runtime safetyCore pack
What it finds
A `systemPrompt`/`system_prompt` pattern without a `sanitize`/`validate`/`escape`/boundary pattern nearby.
Why it matters
Unsanitized system prompts are vulnerable to adversarial redirection from untrusted input the agent reads.
How to fix it
Sanitize all user/external input before inclusion in prompts; define strict system/user content boundaries.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- PROMPT_INJECTION_SURFACE
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Agent source with a system prompt
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Unsandboxed browser automationAV-RUNTIME-008 · High