# llm_prescan report

files scanned: 2 — findings: 12

## HIGH
- `SECRET-IN-CONTEXT` app.py:14 — env/vault value interpolated into a prompt/message string — credentials ship to the provider and every log
- `LLM-OUTPUT-EXEC` app.py:28 — model output (body) reaches an exec/eval sink — generated code runs as-is
- `LLM-OUTPUT-SQL` app.py:32 — model output (body) into a SQL sink — generated queries execute verbatim
- `LLM-DISPATCH-DYNAMIC` app.py:40 — getattr() on model output (body) — the model picks the attribute/method to invoke
## MEDIUM
- `PROMPT-USER-CONCAT` app.py:18 — request input assigned wholesale into a prompt/messages variable — caller controls the content
- `ROLE-FROM-REQ` app.py:18 — message role taken from request input — the caller can claim system/developer authority
- `LLM-OUTPUT-FETCH` app.py:36 — model output (body) into an HTTP fetch — the model chooses the target (SSRF channel)
- `UNBOUNDED-AGENT-LOOP` app.py:45 — unbounded loop containing an LLM call with no iteration/step/budget cap — a runaway burns tokens until killed
- `LLM-OUTPUT-HTML` web.jsx:11 — model output (html) rendered into HTML/markdown — generated markup lands in the DOM
## LOW
- `LLM-NO-VALIDATION` app.py:9 — file references an LLM SDK and carries zero output-validation vocabulary (no schema/parse/validate) — output trusted blind
- `LLM-LOG-CONTENT` app.py:21 — log line emits prompt/messages — user PII and the system prompt land in logs
- `LLM-NO-VALIDATION` web.jsx:5 — file references an LLM SDK and carries zero output-validation vocabulary (no schema/parse/validate) — output trusted blind