Vibe coding is exactly where unvalidated sinks ship. On October 21, 2026, CVE-2026-114107 was disclosed for HKUDS Vibe-Trading: a prompt injection that escalated to a root shell, rated CVSS 8.7. The advisory names the root cause in one sentence — an LLM-callable tool primitive shipped with zero input validation between the LLM and the sink. When a model writes the tool and also supplies its inputs, that missing check is the whole vulnerability. Paste your own agent tool code below and see which side of that line it sits on.
The short answer: a sink gap exists when model-controlled text can reach a shell, SQL query, file write or outbound request with nothing constraining it in between. This page scans pasted Python for sink patterns and validation signals and returns one of three verdicts — SINK GAP, VALIDATED or NO SINK FOUND. It is a quick browser peek, not a full audit.
An execution sink is the place where data becomes action: a shell command, a SQL query, a file write or an outbound request. In vibe coding workflows the model often writes both the tool and its inputs, so an unvalidated sink turns any prompt injection into direct code execution on your machine.
The Vibe-Trading chain, as described in the advisory, has five links — and only one of them needed to break:
Links 1 to 3 are hard to eliminate: models read untrusted documents, and models can be steered. Link 4 is entirely in the tool author's control. A single allowlist check, a full-string match, or an argument array instead of shell=True breaks the chain at the cheapest possible point. The advisory's lesson generalises to every agent framework: audit the gap between the LLM and the sink, not just the prompt.
Try the two preloads first — one vulnerable, one fixed — then paste your own Python tool function. Nothing leaves your browser: the scan is pure client-side pattern matching, clearly a quick peek and not a full audit. For a repository-wide scan, use the full open-source tool: sink-gap-scanner by Ingenious AI on GitHub (queued for publication).
subprocess without shell=True; where a string is unavoidable, quote with shlex.quote.execute.isinstance and length guards plus a re.fullmatch pattern for free-text fields, checked before the sink — not after.requests.An execution sink is the point where data stops being text and becomes action: a shell command runs, a SQL query executes, a file is written, or a request leaves for a URL. If model output can reach that point unchanged, whoever controls the model's input effectively controls the action the sink performs.
A blocklist tries to name everything dangerous, and attackers only need one spelling, encoding or separator you forgot. An allowlist names the small set of values that are legitimate — three actions, five filenames, one URL host — and rejects everything else by default, including attack shapes nobody has invented yet.
Validation counts when it constrains the value before the sink sees it: membership in an allowlist, a full-string regex match, a strict type and length check, parameterised SQL instead of string formatting, or shell quoting plus an argument array instead of shell=True. A comment saying the input is trusted does not count.
A sandbox limits the damage after a bad command runs: fewer permissions, no network, an isolated filesystem. Validation stops the bad command from being constructed at all. Sandboxes fail open when they are misconfigured or escaped; validated inputs never become commands in the first place. Serious setups use both layers together.
No. The checker on this page is plain client-side JavaScript pattern matching that runs entirely in your browser — your code is never uploaded, logged or transmitted. It is a quick peek, not a full audit. For a deeper scan of a whole repository, use the open-source sink-gap-scanner tool from Ingenious AI, which runs locally on your own machine.
Related checks:
Get early access to the Ingenious AI platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI
Get early access on WhatsApp →
Incident framing on this page is based on the CVE-2026-114107 advisory for HKUDS Vibe-Trading as disclosed on October 21, 2026 (CVSS 8.7, prompt injection to root shell; root cause stated as zero input validation between the LLM and the sink). The checker above is a lightweight client-side pattern scan — a quick browser peek, not a full audit: it can miss sinks and can flag code that is safe in context. No pasted code is transmitted or stored. The full repository scanner is the open-source sink-gap-scanner from Ingenious AI.