exec(response.output_text), a NEXT_PUBLIC_OPENAI_API_KEY in .env.local, or f"SELECT ... WHERE category = '{category}'" with a category the model chose: each one turns a single prompt injection, or one look at your JavaScript bundle, into a real incident. This skill finds those and seven other mistakes in apps that call LLMs before you ship, and tells you how to fix each one.

Your agent runs a scanner on your Python, JavaScript and TypeScript files (React, Vue and Svelte components included) that use OpenAI, Anthropic, Google GenAI, Mistral, Groq, Ollama, LangChain, LlamaIndex, the Vercel AI SDK or the OpenAI Agents SDK, and on your .env files. It skips comments and fixed strings, follows model output through variables, loops, .map() callbacks, React state and helper functions, and knows the usual fixes (query parameters, DOMPurify, an allow list of personas, needs_approval, a read-only database connection). It never runs your code or calls a model. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• L01: LLM API keys written in code (OpenAI, Anthropic, Groq, xAI, Hugging Face and other key formats, or literals passed to a client)

• L02: model output passed to eval, exec, subprocess, child_process or new Function

• L03: model output put into SQL text with f-strings, + or template literals

• L04: LLM keys sent to the browser (NEXT_PUBLIC_, VITE_ and EXPO_PUBLIC_ key variables, dangerouslyAllowBrowser)

REVIEW (check before release)

• L11: request input in the system or developer prompt

• L12: model calls with no output token limit (Anthropic calls always have one and are not flagged)

• L13: full prompts, chat messages or model responses written to logs

• L14: model output rendered as raw HTML (dangerouslySetInnerHTML, innerHTML, v-html, unsafe_allow_html)

• L15: agent tools that run shell commands or code, or write files, without approval

• L16: model-written SQL run as it is, and text-to-SQL agents without a read-only connection

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads each file on its own: model output passed to code in another file, prompt templates stored elsewhere, retrieved documents, provider-side settings and the sandbox your tools run in are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 21 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (12 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.