rules-llm

AI API call detected. Ensure max_tokens/max_output_tokens is set to prevent runaway costs from unexpectedly long responses.

Temperature above 1.0 makes model outputs highly random and unpredictable. Values above 1.0 are rarely appropriate for production use cases.

AI API key hardcoded in source. Keys expose your account to abuse and billing fraud. Use environment variables: process.env.OPENAI_API_KEY or os.environ['ANTHROPIC_API_KEY']

Executing LLM output directly as a shell command or eval is an RCE vulnerability. An adversarial prompt or a jailbreak can inject arbitrary commands. Parse and validate LLM output as structured data (JSON schema) and map to a fixed allowlist of operations.

Logging full LLM responses may capture PII, confidential business data, or sensitive content. Log metadata (tokens, latency, model) but not the response body.

Dispatching tool calls via getattr()/locals()/globals() using an LLM-provided name allows prompt injection to call arbitrary functions. Maintain an explicit dict mapping allowed tool names to their callables and reject any name not in that dict.

Unpinned model alias (e.g., 'gpt-4') may resolve to a different model after a provider update, silently changing behavior and costs. Pin to a dated model ID where possible.

User-controlled content in system prompt enables prompt injection. The system prompt should be static — interpolate user data into user messages only.