@noctcore/eslint-plugin-llm

LLM output treated as untrusted input: model text kept out of eval, shells, raw SQL, HTML, fetch origins and fs paths.

What it solves

A model writes what its prompt steers it toward, and the prompt carries the user’s message, retrieved documents and tool results along with your instructions. A prompt injection in any of them comes back out as model output. Sent to innerHTML it is XSS, to exec it is code execution, to $queryRawUnsafe it is SQL injection. This is OWASP LLM05, Improper Output Handling.

What it will yell at you about

It will yell at you about the result of an OpenAI, Anthropic or Vercel AI SDK call reaching a dangerous sink in the same function, with nothing in between that validates or sanitizes it. It follows const bindings and destructuring, not function calls, so it stays silent whenever the chain is not visible in the source. It is a bad fit if you call models through your own wrapper everywhere, because the rule recognises the SDKs’ own response shapes and will not see through the wrapper.

Install and configure

Install

npm install --save-dev @noctcore/eslint-plugin-llm @typescript-eslint/parser
# or: bun add -D / pnpm add -D @noctcore/eslint-plugin-llm @typescript-eslint/parser

eslint.config.js

// eslint.config.js
import tsParser from '@typescript-eslint/parser';
import llm from '@noctcore/eslint-plugin-llm';

export default [
  {
    ...llm.configs.recommended,
    files: ['**/*.{ts,tsx}'],
    languageOptions: { parser: tsParser },
  },
];

The recommended preset enables 1 of 1 rule.

Rules

Each rule links to its page, with the options it takes and Incorrect and Correct examples. Start with no-llm-output-to-sink.

Rule	What it reports	Preset	Fix	Types
no-llm-output-to-sink	Text an LLM SDK call returned must not reach eval, a shell, raw SQL, HTML injection, a fetch origin or an fs path in the same function without being validated or sanitized first.	error

Preset: severity in configs.recommended; off means the preset registers the rule switched off, not listed means it leaves the rule out; both are opt-in, so you turn the rule on yourself. Fix: whether the rule ships an autofix or an editor suggestion. Types: whether the rule needs a type-checked program (parserOptions.projectService).