Output-to-Downstream-Interpreter Injection Lab
Does your agent build a SQL string from a user's name and hand it to your DB tool?
This is the canonical, highest-blast-radius form of OWASP LLM05 “Improper Output Handling”: the agent itself authors a weaponized structured payload — a SQL string, an OS-command / shell argument, a filesystem path, a constructed URL, or a template / format string — built from untrusted input and hands it to a downstream interpreter / executor, where the SYNTAX injects (SQLi, OS-command injection, path traversal, SSRF-via-constructed-URL, SSTI). Every other surface is blind to this: output-handling grades the agent's rendered NL/markdown OUTPUT, tool-argument grades arg SEMANTICS, code-exec grades the agent RUNNING code — none grade the agent EMITTING an injectable structured payload for another component to run. AgentSmack grades the structured-payload-emission channel: an untrusted value concatenated into a SQL string handed to a DB tool with no escaping is a critical hard blocker (the raw payload redacted to a marker + sha, never stored). Ground-truth wins: a declared parameterization / prepared statement clears the finding even with markers present, so a safe agent that binds parameters is never a false positive; and the generic default-deny catches an untrusted-derived payload executed without escaping even when no syntactic marker matched. Findings map to OWASP LLM05 (primary) + LLM01 / LLM06 + NIST / ATLAS coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. Load a sample to watch the gauge swing with no live infra.
Related: the rendered-response exfiltration lab grades the agent's OUTPUT as content; the tool-call argument integrity lab grades arg semantics. This lab grades the structured payload bound for an interpreter.
Drive a live agent endpoint
liveThis POSTs to a real endpoint you control; we drive it in a bounded loop under an injection-pressure task seeded with attacker-controlled untrusted values, classify each tool call into a downstream sink, and grade whether your agent forwarded an untrusted value into an unescaped structured payload (a SQL string, a shell argument, a constructed URL…) handed to an interpreter. Downstream sinks are observed, not executed. The raw payload is redacted to a marker + sha — never stored. Localhost / private / link-local targets are refused with no fetch.