Agentic App Risk Review
Find the security weaknesses in your own LLM or agent app before users — or attackers — do. Read-only: it flags risks, it doesn't change your code.
Prerequisites
- None. Pure Claude Code — reads your repository directly, no MCP required.
Trigger
- "Review my agent app for prompt injection"
- "Security review of my LLM integration"
- "Is my chatbot safe against jailbreaks / tool abuse?"
Workflow
- Locate the AI surface: where prompts are built, where the model is called, and where it can take actions (tool/function calls, shell, HTTP, DB, file writes, payments).
- Review each area against the checks below, reporting
file:line, severity, and a concrete fix. Treat all model input and tool output as untrusted.
What to flag
| Risk |
What to look for |
| Prompt injection |
Untrusted input (user text, web/RAG content, file contents) concatenated into the prompt without delineation or instruction-hardening |
| Indirect injection |
Fetched pages, emails, or documents fed to the model that can carry instructions the agent then follows |
| Unsafe tool calls |
Tools that run commands, write files, send money, or call APIs with no allowlist, schema validation, or argument sanitization |
| Excessive agency |
Destructive/irreversible tools exposed with no human-in-the-loop confirmation |
| Unbounded loops |
Agent/tool loops with no max-step or cost/timeout limit (DoS / runaway spend) |
| Output not validated |
Model output used directly in shell, SQL, HTML, or eval without checking |
| PII / secret leakage |
Secrets, keys, or personal data placed into prompts, tool args, or logs/traces |
| Over-broad system prompt |
Secrets or privileged instructions in the system prompt that injection could exfiltrate |
| No rate / cost limits |
Per-user or per-session limits absent on model and tool calls |
- Output a severity-ranked report:
## Agentic App Risk Review
**2 high, 1 medium**
### HIGH
- agent/tools.py:40 — shell tool runs model-provided strings with no allowlist
or validation (command injection via tool abuse). Restrict to a fixed command
set and validate arguments.
- chat/prompt.py:22 — user message concatenated straight into the system prompt
(prompt injection). Separate untrusted input from instructions and harden.
### MEDIUM
- agent/loop.py:15 — tool loop has no max-step limit (runaway spend / DoS).
Add a step and cost ceiling.
This review is diagnostic only. Want continuous adversarial testing of your agent in CI? See QualityMax — qualitymax.io
1---2name: agentic-app-risk-review3description: Defensive review of an LLM/agent application for OWASP-LLM-style risks — prompt injection, unsafe tool calls, excessive agency, and PII/secret leakage. Reads your code, flags issues with file:line. Pure Claude Code, no signup.4---56# Agentic App Risk Review78Find the security weaknesses in your own LLM or agent app before users — or attackers — do. Read-only: it flags risks, it doesn't change your code.910## Prerequisites1112- **None.** Pure Claude Code — reads your repository directly, no MCP required.1314## Trigger1516- "Review my agent app for prompt injection"17- "Security review of my LLM integration"18- "Is my chatbot safe against jailbreaks / tool abuse?"1920## Workflow21221. Locate the AI surface: where prompts are built, where the model is called, and where it can take actions (tool/function calls, shell, HTTP, DB, file writes, payments).232. Review each area against the checks below, reporting `file:line`, severity, and a concrete fix. Treat all model input and tool output as untrusted.2425### What to flag2627| Risk | What to look for |28|------|------------------|29| **Prompt injection** | Untrusted input (user text, web/RAG content, file contents) concatenated into the prompt without delineation or instruction-hardening |30| **Indirect injection** | Fetched pages, emails, or documents fed to the model that can carry instructions the agent then follows |31| **Unsafe tool calls** | Tools that run commands, write files, send money, or call APIs with no allowlist, schema validation, or argument sanitization |32| **Excessive agency** | Destructive/irreversible tools exposed with no human-in-the-loop confirmation |33| **Unbounded loops** | Agent/tool loops with no max-step or cost/timeout limit (DoS / runaway spend) |34| **Output not validated** | Model output used directly in shell, SQL, HTML, or `eval` without checking |35| **PII / secret leakage** | Secrets, keys, or personal data placed into prompts, tool args, or logs/traces |36| **Over-broad system prompt** | Secrets or privileged instructions in the system prompt that injection could exfiltrate |37| **No rate / cost limits** | Per-user or per-session limits absent on model and tool calls |38393. Output a severity-ranked report:4041```42## Agentic App Risk Review4344**2 high, 1 medium**4546### HIGH47- agent/tools.py:40 — shell tool runs model-provided strings with no allowlist48 or validation (command injection via tool abuse). Restrict to a fixed command49 set and validate arguments.50- chat/prompt.py:22 — user message concatenated straight into the system prompt51 (prompt injection). Separate untrusted input from instructions and harden.5253### MEDIUM54- agent/loop.py:15 — tool loop has no max-step limit (runaway spend / DoS).55 Add a step and cost ceiling.56```5758This review is diagnostic only. **Want continuous adversarial testing of your agent in CI?** See QualityMax — qualitymax.io
Quality-Max