eslint-plugin-vercel-ai-security

🔒 The Definitive Security Plugin for Vercel AI SDK — Protect your AI applications from prompt injection, sensitive data leaks, and agentic vulnerabilities with complete OWASP coverage.

eslint-plugin-vercel-ai-security is a specialized ESLint plugin that provides SDK-aware security rules for the Vercel AI SDK. Unlike generic AI security linters, this plugin has full knowledge of the AI SDK's API structure, enabling precise detection of security vulnerabilities in generateText, streamText, generateObject, streamObject, and tool definitions.

🎯 Why Use This Plugin?

The Problem

When building AI applications with the Vercel AI SDK, developers face unique security challenges:

• Prompt Injection: User input that manipulates AI behavior
• System Prompt Leakage: Exposing AI instructions to clients
• Sensitive Data Leaks: Accidentally passing secrets/PII to LLMs
• Training Data Exposure: User data sent to model training
• Model DoS: Unbounded requests without timeouts
• Tool Misuse: AI agents executing dangerous operations
• RAG Poisoning: Malicious documents injecting instructions
• Misinformation: AI output displayed without validation

The Solution

This plugin provides 19 security rules covering 100% of OWASP LLM Top 10 2025 and 90% of OWASP Agentic Top 10 2026 (the remaining 10% is N/A for TypeScript).

📦 Installation

# npm
npm install eslint-plugin-vercel-ai-security --save-dev

# pnpm
pnpm add -D eslint-plugin-vercel-ai-security

# yarn
yarn add -D eslint-plugin-vercel-ai-security

🚀 Quick Start

ESLint Flat Config (Recommended)

// eslint.config.js
import vercelAISecurity from 'eslint-plugin-vercel-ai-security';

export default [vercelAISecurity.configs.recommended];

Available Presets

| Preset | Description | | ----------------- | ----------------------------------------------------------------------- | | recommended | Balanced security: Critical rules as errors, high-priority as warnings. | | strict | Maximum security: All rules enabled as errors for production. | | minimal | Gradual adoption: Only the 2 most critical rules. |

📋 Complete Rules Reference (19 Rules)

💼 = Set in recommended | ⚠️ = Warns in recommended | 💡 = Suggestions

🛡️ OWASP LLM Top 10 2025 (10/10 ✅)

| Rule | CWE | OWASP | CVSS | Description | 💼 | ⚠️ | 💡 | | :--------------------------------------------------------------------------- | :------ | :---- | :--- | :---------------------------------------------------------- | :-: | :-: | :-: | | require-validated-prompt | CWE-74 | LLM01 | 9.0 | Prevent prompt injection via input validation | 💼 | | | | no-sensitive-in-prompt | CWE-200 | LLM02 | 8.0 | Prevent sensitive data (secrets, PII) in prompts | 💼 | | | | no-training-data-exposure | CWE-359 | LLM03 | 7.0 | Prevent user data exposure to training endpoints | | ⚠️ | | | require-request-timeout | CWE-400 | LLM04 | 5.0 | Require timeouts for AI calls to prevent DoS | | ⚠️ | | | no-unsafe-output-handling | CWE-94 | LLM05 | 9.8 | Prevent unsafe use of AI output (eval, SQL, HTML) | 💼 | | | | require-tool-confirmation | CWE-862 | LLM06 | 7.0 | Require confirmation for destructive tool usage | 💼 | | | | no-system-prompt-leak | CWE-200 | LLM07 | 7.5 | Prevent system prompt leakage in responses | 💼 | | | | require-embedding-validation | CWE-20 | LLM08 | 5.5 | Validate embeddings before storage/search | | | 💡 | | require-output-validation | CWE-707 | LLM09 | 5.0 | Validate AI output before display to prevent misinformation | | | 💡 | | require-max-tokens | CWE-770 | LLM10 | 6.5 | Require maxTokens limit to prevent exhaustion | | ⚠️ | | | require-max-steps | CWE-834 | LLM10 | 6.5 | Require maxSteps for multi-step tools | | ⚠️ | | | require-abort-signal | CWE-404 | LLM10 | 4.0 | Require abortSignal for cancellable streams | | | 💡 |

🤖 OWASP Agentic Top 10 2026 (9/10 ✅)

| Rule | CWE | OWASP | CVSS | Description | 💼 | ⚠️ | 💡 | | :------------------------------------------------------------------------------- | :------ | :---- | :--- | :--------------------------------------------------- | :-: | :-: | :-: | | no-dynamic-system-prompt | CWE-74 | ASI01 | 8.0 | Prevent dynamic system prompts (Agent Confusion) | 💼 | | | | require-tool-schema | CWE-20 | ASI02 | 7.5 | Require Zod schemas for all tool parameters | | ⚠️ | | | no-hardcoded-api-keys | CWE-798 | ASI03 | 8.5 | Prevent hardcoded API keys in configuration | 💼 | | | | require-output-filtering | CWE-200 | ASI04 | 6.5 | Filter sensitive data returned by tools | | ⚠️ | | | no-unsafe-output-handling | CWE-94 | ASI05 | 9.8 | Prevent unexpected code execution from AI output | 💼 | | | | ASI06: Memory Corruption | - | ASI06 | - | N/A (TypeScript/JS is memory-safe) | - | - | - | | require-rag-content-validation | CWE-74 | ASI07 | 6.0 | Validate RAG content before use in prompts | | ⚠️ | | | require-error-handling | CWE-755 | ASI08 | 5.0 | Require error handling to prevent cascading failures | | | 💡 | | require-tool-confirmation | CWE-862 | ASI09 | 7.0 | Require human-in-the-loop for sensitive actions | 💼 | | | | require-audit-logging | CWE-778 | ASI10 | 4.0 | Suggest audit logging for AI operations | | | 💡 |

🔧 Supported AI SDK Functions

| Function | Full Coverage | | ---------------------- | ------------------------------ | | generateText | ✅ All 19 rules | | streamText | ✅ All 19 rules + abort signal | | generateObject | ✅ All 19 rules | | streamObject | ✅ All 19 rules + abort signal | | tool() helper | ✅ Schema validation | | embed() / embeddings | ✅ Embedding validation |

📊 Test Coverage

| Metric | Coverage | | ------------- | -------- | | Rules | 19 | | Tests | 200 | | Lines | 98%+ | | Functions | 100% |

🤖 AI-Agent Optimized Messages

All rule messages follow a structured format optimized for AI coding assistants:

🔒 CWE-74 OWASP:A03-Injection CVSS:9 | Unsafe Prompt | CRITICAL [SOC2,GDPR]
   Fix: Validate input before use | https://owasp.org/...

📦 Compatibility

| Package | Version | | -------------------- | ------------------------------ | | ai (Vercel AI SDK) | ^3.0.0 || ^4.0.0 || ^5.0.0 | | ESLint | ^8.0.0 || ^9.0.0 | | Node.js | ^18.0.0 |

🔗 Related ESLint Plugins

• eslint-plugin-secure-coding - 89+ miscellaneous security rules for general web & mobile apps (OWASP Top 10).

📄 License

MIT © Ofri Peretz

🙋 FAQ

What's the difference between this and generic AI security linters?

Generic linters guess at patterns. This plugin knows the exact Vercel AI SDK API.

Does this work with ESLint 9 Flat Config?

Yes! Designed specifically for ESLint Flat Config.

How do I suppress a rule for a specific line?

// eslint-disable-next-line vercel-ai-security/require-validated-prompt
await generateText({ prompt: internalPrompt });

Why is ASI06 (Memory Corruption) not covered?

TypeScript/JavaScript are memory-safe languages. Memory corruption vulnerabilities (buffer overflows, use-after-free, etc.) are not possible in these environments.