Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents

Hang Cui

cs.CROct 2, 2026

Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents

Authors: Hang Cui

Abstract

Large language model (LLM)-based agents increasingly connect model-generated decisions to security-sensitive software capabilities such as command execution, filesystem access, network communication, browser control, and external tools. Existing analyses often use predefined sensitive operations as anchors, but operation identity alone is insufficient to determine security implications. We present AgentSecGraph, a security-aware static analysis framework that constructs a candidate-centered Security-Aware Agent Dependency Graph (Security-ADG) for each security-sensitive operation. It augments operation identity with agent relevance, source and dependency evidence, trust-boundary context, guard evidence, and external-effect semantics. We further introduce AgentSecBench, a corpus of 67 real-world LLM-agent repositories spanning 11 ecosystems and 37,542 source files. The current analyzer identifies 23,866 static security-sensitive operation candidates across 65 repositories and emits one Security-ADG artifact per candidate. Corpus-wide analysis recovers source-to-operation dependency evidence for 9,821 candidates (41.15%) and potential guard evidence for 3,075 (12.88%), completing in 50.8 minutes. Using a separate reproduction-backed evaluation layer, we establish 22 security-sensitive behaviors across 13 repositories: one confirmed vulnerability, one pending disclosure candidate, and 20 guarded behaviors. In nine held-out cases, Security-ADG preserves 91.1% of the reference context and all five observed guards, compared with 20.0% for a sink-only view and 40.0% for a simplified ADG. These results show that security-aware dependency and contextual evidence enable distinctions that cannot be recovered from sensitive-operation identity alone.

Figures & tables

Figure 1. Motivation: operation identity alone does not determine security semantics. All three agent tools contain the same command-execution operation. Cases A and C preserve a dependency from the agent-facing input, whereas Case B removes that dependency through a constant overwrite. Case C additionally contains a candidate allowlist guard. Security-aware dependency analysis distinguishes these cases using dependency and security-context evidence.

Figure 2. Overview of AgentSecGraph . Starting from a security-sensitive operation candidate, AgentSecGraph normalizes framework-specific agent semantics, identifies relevant sources, recovers dependency and security-context evidence, and constructs a candidate-centered Security-ADG for subsequent analysis and review. Overview of the AgentSecGraph analysis pipeline. A security-sensitive operation serves as the analysis anchor. Framework-specific agent semantics and input sources are normalized, local dependency, trust-boundary, guard, and external-effect evidence are recovered, and the resulting evidence is represented as a candidate-centered Security-ADG.

Figure 3. Example candidate-centered Security-ADG . The representation augments a security-sensitive operation with agent-facing source provenance, dependency relationships, trust-boundary evidence, candidate guards, and the resulting external effect. Relations prefixed with may_ represent static evidence rather than proofs of reachability or exploitability. Example Security-Aware Agent Dependency Graph centered on a security-sensitive operation. The graph contains an agent-facing program construct, input source, dependency evidence, trust boundary, guard evidence, sensitive operation, and external effect.

Type	Meaning
Agent/program symbol	Agent-facing or enclosing program construct associated with the candidate.
Sensitive operation	Candidate operation that performs or prepares a security-relevant effect.
Input source	Value originating from an agent-facing or external context.
Trust boundary	A crossing from a less-trusted or external context to a local capability.
Guard candidate	Validation, authorization, sandboxing, argument restriction, or related defensive evidence.
External effect	An abstract effect involving a process, filesystem, network, browser, or external service, deterministically assigned from the operation category.

Table 1. Core node and edge types in Security-ADG . Relations prefixed with may_ represent static evidence rather than reachability or exploitability proofs.

Corpus-Wide Analysis		Reproduction Evidence
Statistic	Value	Outcome	Count
Frozen repositories	67	Reproduction-confirmed behaviors	22
Agent ecosystems	11	Repositories represented	13
Source files	37,542	Vulnerability ground truth	1
Source size	291.2 MB	Pending disclosure candidate	1
Candidate-bearing repositories	65	Guarded non-vulnerability	20

Table 2. Corpus-wide analysis and reproduction evidence. Candidate counts are not vulnerability findings.

Evidence or artifact	Count	Rate
Framework-specific evidence	749	3.14%
Source-to-operation dependency evidence	9,821	41.15%
Potential guard evidence	3,075	12.88%
Generated Security-ADG artifacts	23,866	100.0%

Table 3. Evidence recovered in the current full-corpus run. Rates use all 23,866 candidates as the denominator.

Metric	Observed result
Repositories completed	67/67
Candidates / generated graphs	23,866 / 23,866
Candidate extraction	1,508.5 s
Security-ADG construction	1,538.2 s
End-to-end wall time	3,046.6 s (50.8 min)
Throughput	7.83 candidates/s

Table 4. Scalability results from one completed full-corpus run.

Representation	Context Completeness	Guard Visibility
Sink-only	20.0%	0/5
Simplified ADG	40.0%	0/5
Security-ADG	91.1%	5/5

Table 5. Security-context preservation across representation variants. Higher values indicate that more reference context is preserved.

Approach	Setting	Agent Dep.	Context	Primary Focus
AgentFuzz ( Liu et al., 2025 )	Grey-box	No	Partial	Vulnerability triggering
TaintP2X ( He et al., 2026a )	Static	Partial	Partial	Prompt-to-sink detection
Agent Audit ( Zhang et al., 2026 )	Static	Partial	Yes	Agent security auditing
AgentFlow ( Wang et al., 2026a )	Static	Yes	Partial	Dependency recovery
Agent-BOM ( Li et al., 2026a )	Runtime	Yes	Yes	Runtime reconstruction
AgentSecGraph	Static	Yes	Yes	Contextual behavior evidence

Table 6. Positioning against closely related approaches. “Context” denotes explicit security-relevant evidence beyond operation identity.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Corpus property	Value
Frozen repositories	67
Agent ecosystems	11
Source files	37,542
Source size	291.2 MB
Primarily Python repositories	51
Primarily TypeScript repositories	7

Appendix

Table 7. Aggregate composition of the frozen AgentSecBench corpus. Candidate counts characterize the current analyzer and are not vulnerability counts.

Framework family	Construct family	Normalized interpretation
MCP / FastMCP	Tool decorators and server-side tool registration	Agent-facing callable and exposed parameters
LangChain	Tool decorators, callable wrappers, and toolkit exports	Tool capability associated with its callable
CrewAI	Tool declarations and tool collections attached to agents or tasks	Agent-available capability
AutoGen	Function or tool registration between conversational agents and executors	Registered callable capability
OpenAI Agents SDK	Function-tool wrappers and tools attached to an agent	Agent-facing callable capability
Semantic Kernel	Kernel-function declarations and plugin methods	Kernel-exposed callable capability

Appendix

Table 8. Framework construct families represented by the frozen adapter registry. Concrete selectors are versioned with the implementation.

Rater	Exact identifier and interface	Inference and output settings
M1	openai/gpt-5-mini ; OpenRouter	Medium reasoning; reasoning excluded; JSON Schema
M2	anthropic/claude-sonnet-4.6 ; OpenRouter	Medium reasoning; reasoning excluded; JSON Schema
M3	google/gemini-3.5-flash-lite ; OpenRouter	Medium reasoning; reasoning excluded; JSON Schema
M4	qwen/qwen3-max ; OpenRouter	Provider-default reasoning; JSON Schema
M5	deepseek-v4-pro ; DeepSeek official API	Thinking enabled, high; reasoning not stored; JSON object with local schema validation

Appendix

Table 9. Frozen five-model pre-annotation panel.

Case	Repository	Behavior	Evidence mode	Guard posture
HSQ-0014	dddabtc/winremote-mcp	shell command execution	local monkeypatch proof	no_guard_confirmed
HSQ-0087	dddabtc/winremote-mcp	application launch	local monkeypatch proof	no_guard_confirmed
HSQ-0089	dddabtc/winremote-mcp	desktop notification script	local monkeypatch proof	guarded
HSQ-0091	dddabtc/winremote-mcp	network diagnostic process	local monkeypatch proof	no_guard_confirmed
HSQ-0103	dddabtc/winremote-mcp	service control	local monkeypatch proof	guarded
HSQ-0211	nexu-io/html-anything	agent CLI discovery process	source-level construction proof	no_guard_confirmed

Appendix

Table 10. Evidence provenance for the held-out context-preservation cases. Repository identifiers are retained to make the frozen evidence auditable; no row is a vulnerability claim.

Case	Guard posture	Applicable	Sink-only	Simplified ADG	Security-ADG
HSQ-0014	no_guard_confirmed	5	1/5	2/5	4/5
HSQ-0087	no_guard_confirmed	5	1/5	2/5	4/5
HSQ-0089	guarded	5	1/5	2/5	5/5
HSQ-0091	no_guard_confirmed	5	1/5	2/5	4/5
HSQ-0103	guarded	5	1/5	2/5	5/5
HSQ-0211	no_guard_confirmed	5	1/5	2/5	4/5

Appendix

Table 11. Case-level representation retention. Each case has five applicable reference dimensions: operation, effect, dependency, trust boundary, and guard posture.

Representation	Retained	Completeness	Guard visibility
Sink-only	9/45	20.0%	0/5
Simplified ADG	18/45	40.0%	0/5
Security-ADG	41/45	91.1%	5/5

Appendix

Table 12. Micro-averaged context completeness and positive guard visibility.

Evidence or artifact	Count	Rate
Framework-specific evidence	749	3.14%
Source-to-operation dependency evidence	9,821	41.15%
Potential guard evidence	3,075	12.88%
Generated Security-ADG artifacts	23,866	100.00%

Appendix

Table 13. Aggregate evidence recovered in the current full-corpus run. Rates use all 23,866 static candidates as the denominator. Candidate counts are not vulnerability findings.

Category	Candidates	Dependency	Guard	Trust-crossing
browser_control	588	11 (1.87%)	13 (2.21%)	11 (1.87%)
command_execution	2,722	933 (34.28%)	315 (11.57%)	933 (34.28%)
credential_access	2,548	251 (9.85%)	454 (17.82%)	251 (9.85%)
database_access	1,304	106 (8.13%)	36 (2.76%)	106 (8.13%)
dynamic_code_execution	55	24 (43.64%)	23 (41.82%)	24 (43.64%)
external_tool_invocation	5,344	603 (11.28%)	73 (1.37%)	603 (11.28%)

Appendix

Table 14. Corpus-wide evidence by security-sensitive operation category. Percentages are relative to the number of candidates in each row.

Metric	Observed result
Frozen repositories processed	67 / 67
Repositories with candidates	65
Candidate-bearing source files	7,214
Static candidates	23,866
Generated Security-ADG artifacts	23,866
Candidate extraction time	1,508.456 s

Appendix

Table 15. Scalability measurements from one completed full-corpus run. The measurements characterize the observed execution environment and are not presented as cross-system performance estimates.

Category	Count
Command execution	76
Filesystem write	62
External tool invocation	58
Network access	46
Filesystem read	43
Browser control	27

Appendix

Table 16. Category distribution of the frozen 344-operation held-out inventory. The inventory is finite and is not treated as exhaustive repository-wide ground truth.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 330 papers

Agent Audit: A Security Analysis System for LLM Agent Applications
Mar 24, 2026Haiyue Zhang, Yi Nian, Yue ZhaoAI Agent Auditing LLM Agent Security
University of Southern California Los Angeles, California, USA
Towards Security-Auditable LLM Agents: A Unified Graph Representation
May 7, 2026Chaofan Li, Lyuye Zhang, Jintao Zhai +9LLM Agent Security Multi-Agent System Security
Huazhong University of Science and Technology, China · Nanyang Technological University, Singapore, Singapore · Chongqing University of Posts and Telecommunications, China +2
Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
Jun 9, 2026Yuchen Ling, Shengcheng Yu, Zhenyu Chen +1Prompt Injection LLM Agent Security
State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China · Technical University of Munich, Heilbronn, Germany

Mar 24, 2026J/K move · Enter open · S save

Agent Audit: A Security Analysis System for LLM Agent Applications

Haiyue Zhang, Yi Nian, Yue Zhao

University of Southern California Los Angeles, California, USA

AI Agent Auditing LLM Agent Security Cybersecurity Static Code Analysis

Open paper AskPDF arXiv

What should a developer inspect before deploying an LLM agent: the model, the tool code, the deployment configuration, or all three? In practice, many security failures in agent systems arise not from model weights alone, but from the surrounding software stack: tool functions that pass untrusted inputs to dangerous operations, exposed credentials in deployment artifacts, and over-privileged Model Context Protocol (MCP) configurations. We present Agent Audit, a security analysis system for LLM agent applications. Agent Audit analyzes Python agent code and deployment artifacts through an agent-aware pipeline that combines dataflow analysis, credential detection, structured configuration parsing, and privilege-risk checks. The system reports findings in terminal, JSON, and SARIF formats, enabling direct integration with local development workflows and CI/CD pipelines. On a benchmark of 22 samples with 42 annotated vulnerabilities, Agent Audit detects 40 vulnerabilities with 6 false positives, substantially improving recall over common SAST baselines while maintaining sub-second scan times. Agent Audit is open source and installable via pip, making security auditing accessible for agent systems. In the live demonstration, attendees scan vulnerable agent repositories and observe how Agent Audit identifies security risks in tool functions, prompts, and more. Findings are linked to source locations and configuration paths, and can be exported into VS Code and GitHub Code Scanning for interactive inspection.

Abstract

LLM Agent Security

Explore similar work

Agent Audit: A Security Analysis System for LLM Agent Applications

Towards Security-Auditable LLM Agents: A Unified Graph Representation

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation