AI AGENT
SAST AUDIT.

Audit Intake & Order Fixed ,497

11 Security Vectors Covered Full Matrix

• 01
  Indirect Prompt Injection via Tool Inputs

  Sanitization checks on data returned from external APIs, web scraping, and third-party webhooks.
• 02
  Arbitrary Code & Command Execution

  Static taint tracking on shell executions, eval, subprocesses, and dynamic imports.
• 03
  Tool Schema Privilege Escalation

  Detection of overprivileged tool interfaces and lack of runtime parameter constraints.
• 04
  Credential & API Token Leakage

  Scan for raw bearer tokens, private keys, and environment variables logged in LLM traces.
• 05
  SSRF & Unrestricted Egress Channels

  Detection of unvalidated HTTP webhooks and internal network metadata probing.
• 06
  Autonomous Action Gate Bypass

  Verification of human-in-the-loop triggers for high-impact state modifications.
• 07
  Multi-Turn Memory Poisoning

  Assessment of state stores, vector database embeddings, and session memory manipulation.
• 08
  SQL & Database Query Injection

  Audit of natural-language-to-SQL compilers and parameterized database bindings.
• 09
  Denial of Service & Token Bombing

  Validation of payload length guards, recursion depth caps, and timeout budgets.
• 10
  Insecure File System & Path Traversal

  Verification of sandboxing for agent file reads, writes, and artifact generation.
• 11
  Deterministic Output Scrubbing

  Validation of regex and heuristic outbound scrubbers for PII and sensitive data.