Query ID: js/system-prompt-injection. Security severity 7.8, CWE-1427 (Improper Neutralization of Input Used for LLM Prompting). OWASP LLM01.
Taint tracking from untrusted input to system prompt or agent tool descriptions. Mitigation: use user-role messages, allowlists for system prompt influence, fixed trusted tool description strings.
Included in javascript-code-scanning.qls default suite.