> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Unvalidated tool input parameters

> Tool parameters flow from LLM output to function calls without type, range, or semantic validation

Tool parameters flow from LLM output to function calls without type, range, or semantic validation

## How to resolve

Validate all tool input parameters for type, range, and format before execution. Use allowlists for permitted values. Block chained command patterns.

## Risk

**Governance/Compliance**

This vulnerability falls under [ASI02:2026 — Tool Misuse and Exploitation](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) in the OWASP Top 10 for Agentic Applications. Agent uses legitimate tools in unsafe ways due to over-privilege, bad input, or poisoned descriptors.

**Security**

Tool parameters flow from LLM output to function calls without type, range, or semantic validation. If exploited, this can compromise the agent's integrity, confidentiality, or availability, potentially affecting downstream systems and data.

## Explanation

Tool parameters flow from LLM output to function calls without type, range, or semantic validation. This falls under ASI02 (Tool Misuse and Exploitation): Agent uses legitimate tools in unsafe ways due to over-privilege, bad input, or poisoned descriptors.

## Specifications

**Trigger**

* Agent scan detects tool parameters flow from LLM output to function calls without type, range, or semantic validation

The scanner looks for patterns such as:

* no input validation on tool arguments
* direct use of LLM-generated args in sensitive functions
* no schema enforcement on tool parameters

**Severity**

* MEDIUM

**Applies to**: Agent