skills.rest
mattnowdev
mattnowdevCOMMUNITY
Explore all skills by this author →
GitHub

LLM application security anti-patterns reference loaded by super-review:run

Identify LLM and RAG security anti-patterns in pull requests.

Updated May 15, 2026
Search Tags:#rag#streaming#prompt injection#supply chain#tool validation#llm security
One-click install
npx skills add https://github.com/mattnowdev/super-review --skill llm-application-security-anti-patterns-reference-loaded-by-super-review-run
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: LLM application security anti-patterns reference loaded by super-review:run
Source: https://github.com/mattnowdev/super-review/tree/main/skills/llm-sec
Command: npx skills add https://github.com/mattnowdev/super-review --skill llm-application-security-anti-patterns-reference-loaded-by-super-review-run

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents prompt injection, unsafe tool use, and LLM-driven security regressions by guiding reviewers to spot high-risk anti-patterns in LLM and RAG code before they ship.

Core Features & Use Cases

  • Anti-pattern detection for LLM apps: Covers direct/indirect prompt injection, untrusted context handling, and instruction leakage risks.
  • Unsafe output-sink tracing: Identifies when model output is routed into eval, shell/SQL execution, redirects, or dangerous HTML rendering without validation.
  • Tool-call and agency hardening: Flags missing tool-argument schema validation, excessive agent permissions, unbounded generation cost risks, and unsafe streaming behavior.
  • RAG and supply-chain risks: Targets vector-store retrieval poisoning and slopsquatted or hallucinated dependency patterns tied to LLM workflows.

Quick Start

Use this reference when reviewing a pull request that includes LLM SDK calls or RAG/vector-store code to systematically flag the most critical security anti-patterns.

Frequently Asked Questions about LLM application security anti-patterns reference loaded by super-review:run

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect prompt injection risks in my RAG application code?▼

Detect prompt injection in RAG applications by reviewing pull requests for untrusted context handling and instruction leakage anti-patterns. This process involves tracing external data fed into model prompts and mapping risky code patterns to concrete fixes.

What is the best way to review LLM tool-call handlers for security issues?▼

Review LLM tool-call handlers by checking for missing tool-argument schema validation, excessive agent permissions, and unbounded generation cost risks. Hardening tool agency ensures model outputs and arguments are constrained to strict schemas and safe sinks.

How do I prevent LLM output from executing dangerous code in my pipeline?▼

Prevent dangerous LLM output execution by tracing unsafe output-sinks. Identify and block instances where model output routes directly into eval, shell execution, SQL queries, or dangerous HTML rendering without strict validation.

Does this security review reference work with LangChain and LlamaIndex codebases?▼

Yes, this security review reference applies to codebases using LangChain and LlamaIndex. It targets pull requests touching AI SDKs, vector databases, tool-call handlers, streaming endpoints, and any pipeline feeding external context into prompts.

How can I identify vector-store retrieval poisoning and LLM supply chain risks?▼

Identify vector-store retrieval poisoning and supply chain risks by scanning for slopsquatted or hallucinated dependency patterns tied to LLM workflows. Reviewing RAG code helps target retrieval poisoning before these security regressions ship.

Related Skills

Explore More Software Engineering Skills→
Dokkabei97Dokkabei97
2

ai-integration

Generate LLM API integration code for OpenAI, Anthropic, and Google.

Community
Intermediate
Yangel-hideYangel-hide

guidance

Constrain LLM outputs with regex patterns and grammars for structured formats.

Community
Advanced
89jobrien89jobrien
4

dependency-management

Analyze dependency manifests to update packages, scan vulnerabilities, and verify licenses.

Community
Intermediate
ConnectiveTCSConnectiveTCS

prompt-engineering

Automate secure prompt design and safe task routing for LLM assistants.

Community
Advanced