Security Test: LLM Insecure Plugin Design¶

Description¶

Default Severity: high

LLM insecure plugin design happens when plugins integrated with large language models aren’t properly checked for valid input or overseen for permissions. This means attackers could trick the system into running harmful code or getting sensitive data without proper controls, leading to dangerous outcomes like remote code execution or data theft. Developers often overlook thorough input validation or mistakenly trust external inputs, which can open the door to serious security threats if not fixed.

Reference:

• https://genai.owasp.org/llmrisk/llm07-insecure-plugin-design/
  • https://owasp.org/www-project-top-10-for-large-language-model-applications/

Configuration¶

Identifier: injection/llm_insecure_plugin_design

Examples¶

All configuration available:

checks:
  injection/llm_insecure_plugin_design:
    skip: false # default

Compliance and Standards¶