JS: Add prompt injection detection (CWE-1427) for OpenAI, Anthropic, …

[BazookaMusic]

…and Google GenAI SDKs

Add experimental CodeQL query detecting prompt injection vulnerabilities in JavaScript/TypeScript applications using AI SDK libraries.

Modeled frameworks:

• openai (OpenAI, AzureOpenAI): responses, chat.completions, completions, images, embeddings, beta.assistants, beta.threads, audio APIs
• @openai/agents: Agent instructions, handoffDescription, run/Runner.run, asTool, tool()
• @anthropic-ai/sdk: messages.create, beta.messages.create, beta.agents.create/update
• @google/genai (GoogleGenAI): generateContent, generateContentStream, generateImages, editImage, chats, live.connect

Includes role-based filtering (system/developer/assistant/model roles) and constant-comparison sanitizer guard.

[github-actions]

QHelp previews:

javascript/ql/src/experimental/Security/CWE-1427/PromptInjection.qhelp

Prompt injection

Prompts can be constructed to bypass the original purposes of an agent and lead to sensitive data leak or operations that were not intended.

Recommendation

Sanitize user input and also avoid using user input in developer or system level prompts.

Example

In the following examples, the cases marked GOOD show secure prompt construction; whereas in the case marked BAD they may be susceptible to prompt injection.

from flask import Flask, request
from agents import Agent
from guardrails import GuardrailAgent

@app.route("/parameter-route")
def get_input():
    input = request.args.get("input")

    goodAgent = GuardrailAgent(  # GOOD: Agent created with guardrails automatically configured.
        config=Path("guardrails_config.json"),
        name="Assistant",
        instructions="This prompt is customized for " + input)

    badAgent = Agent(
        name="Assistant",
        instructions="This prompt is customized for " + input  # BAD: user input in agent instruction.
    )

References

• OpenAI: Guardrails.
• Common Weakness Enumeration: CWE-1427.

[BazookaMusic]

Ignore, was trying to create it for the fork