Hub rules-llamaindex

rules-llamaindex

v3 public Verified

Llamaindex

LlamaIndex is a data framework for LLM applications that connects custom data to LLMs. These rules ensure secure and efficient data indexing, retrieval, and synthesis patterns to prevent data leakage and suboptimal query performance.

@sigmashakeinc 2 pulls 5 rules published Apr 8, 2026 synced Oct 18, 2026 sigmashakeinc/rules/rulesets/rules-llamaindex →
Severity
3 error 2 warn 0 info
demo.cast
LlamaIndex is a data framework for LLM applications that connects custom data to LLMs. These rules ensure secure and efficient data indexing, retrieval, and synthesis patterns to prevent data leakage and suboptimal query performance.

Rules index

5 governance rules

Indexed from the repository's .rules files, grouped by technology. Expand any rule to read the raw source.

llamaindex

llamaindex-deprecated-gpt-index warning log

GPTVectorStoreIndex/GPTSimpleVectorIndex and the 'gpt_index' package are deprecated aliases from LlamaIndex v0.x. Migrate to 'from llama_index.core import VectorStoreIndex' (LlamaIndex v0.10+).

Rule source requires an active Pro or Enterprise subscription.
llamaindex-no-eval-of-query-result error block

eval()/exec() on LlamaIndex query results executes LLM-generated content as code. A document injected into the index can trigger arbitrary code execution via prompt injection. Parse LLM output as structured data and validate it before use.

Rule source requires an active Pro or Enterprise subscription.
llamaindex-no-hardcoded-api-key error block

Hardcoded API key in LlamaIndex application. Keys embedded in source are exposed via version control. Use environment variables: os.environ['OPENAI_API_KEY'] or the Settings.llm pattern with SecretStr.

Rule source requires an active Pro or Enterprise subscription.
llamaindex-no-path-traversal-in-reader error block

Constructing document reader paths from user-controlled input enables path traversal (CWE-22). Validate and canonicalize the path against a fixed base directory using os.path.realpath() before passing it to SimpleDirectoryReader or any other document reader.

Rule source requires an active Pro or Enterprise subscription.
llamaindex-no-user-input-in-index-system-prompt warning log

User-controlled content in LlamaIndex system prompts enables indirect prompt injection — an adversarial document in the index can hijack the LLM's instructions. Keep system prompts static and validate all retrieved context before including it.

Rule source requires an active Pro or Enterprise subscription.

Version metadata

Published metadata

The hash-locked record of this published ruleset. When source contents change, the maintainer resyncs and the version bumps.

Version
v3
Published
Apr 8, 2026
Source commits
0
Synced
Oct 18, 2026
Hash
c96624d34fa654e89d62cd54a147950277c438a288e9cfa54cc306e810a48312
Signature
Verified (publisher key)
Tested with
claude-code@current
Plan
Starter (free)
Visibility
Public

Source history

Recent commits

Latest commits touching rulesets/rules-llamaindex/.sigmashake/rules in sigmashakeinc/rules/rulesets/rules-llamaindex. The published version only bumps when a maintainer resyncs.

No commit history available.