LLM defense pack

Three rule groups check code that calls an LLM: token budget, prompt leaks and rate-limit coverage. They run in every vulkro scan.

vulkro scan .
vulkro explain TOK-005

Token budget (TOK-001 to TOK-005)

Rule	Catches	Severity
TOK-001	LLM call without max_tokens (or the vendor equivalent)	Medium
TOK-002	System prompt over 40 KB (about 10k tokens)	Medium
TOK-003	tools=[...] with more than 32 entries	Low
TOK-004	LLM call inside a loop with no cache	Medium
TOK-005	System prompt sent in the user role instead of system	High

TOK-005 is the security rule: a system prompt in the user message can be pulled out with an "ignore previous instructions" request. The others are cost and denial-of-service rules.

Prompt leaks (LEAK-001 to LEAK-003)

Follows prompt variables to output sinks in the same function.

Rule	Catches	Severity
LEAK-001	Prompt returned in an error or response body	Critical
LEAK-002	Prompt written to a log	High
LEAK-003	Prompt attached to telemetry (Sentry set_extra, Datadog set_tag, OpenTelemetry set_attribute)	High

LEAK-001 is the common debugging mistake: the prompt is added to a 500 response, and anyone who can trigger the error reads back the system prompt and tool definitions.

Rate limits (RATE-001 to RATE-004)

Rule	Catches	Severity
RATE-001	No limiter anywhere in the project	Medium per file; High for an anonymous route that calls a payment, LLM or SQL sink
RATE-002	Rate-limit library imported but never set up	High
RATE-003	Auth route limit no stricter than other routes	Medium
RATE-004	Express or Fastify app with no global rateLimit middleware	Medium

Recognised limiters: flask-limiter, django-ratelimit, slowapi, express-rate-limit, @fastify/rate-limit, @nestjs/throttler, rack-attack, tollbooth, httprate.

To test which prompt-injection payloads reach each LLM call, run vulkro scan . --bruteforce-sinks --bruteforce-categories llm.

See also: Bruteforce sinks, AI-code audit