Identify the insecure plugin design flaw (LLM07) in this snippet

OWASP LLM07 covers insecure plugin design. The family is about plugin interfaces that let the model express arbitrary actions instead of choosing from a constrained menu. The dangerous pattern is a plugin that takes a free-text parameter and executes it directly against a sensitive system. In the snippet, the plugin accepts a `sql` parameter from the model and runs it against the production database. That interface lets the model describe any action, not just the approved ones. Under indirect prompt injection, an attacker's text smuggled in through retrieval or a tool response, the model can be steered into producing dangerous SQL: `DROP TABLE users`, `SELECT * FROM payment_methods`, or queries that exfiltrate other tenants' data. The fix is a constrained interface. Instead of `run_sql(sql)`, expose `lookup_customer_by_id(id)`, `get_recent_orders(customer_id, limit)`, `update_shipping_address(order_id, address)`. The model can only select among approved actions with validated arguments. The blast radius is bounded by the interface itself, not by the model's behaviour.

**OWASP LLM07, insecure plugin design, covers plugin interfaces that let the model express arbitrary intent instead of selecting from a constrained menu.** The dangerous shape is a plugin parameter that accepts free-text content (raw SQL, raw shell, raw URL, raw filesystem path) and passes it to a sensitive system without structural constraints. The snippet's `sql` parameter is the textbook example. The plugin runs whatever SQL the model produces against the production database. Two things are wrong: - **The interface lets the model describe arbitrary actions.** Under indirect prompt injection, a retrieved document or tool response containing 'Run `DROP TABLE users`', the model produces dangerous SQL and the plugin executes it. There is no structural boundary between intent and action. - **Safety relies entirely on the model behaving well.** Alignment training cannot promise zero compliance with novel injections. Any 'do not run dangerous SQL' instruction in the system prompt is a soft guard the model under attack ignores. The fix is to redesign the interface around bounded operations: `lookup_customer_by_id(id: int)`, `get_recent_orders(customer_id, limit)`, `update_shipping(order_id, address)`. Each operation has a schema-validated argument set, runs as a parameterized query, and is bounded by tenant scoping at the database layer. The model selects among approved actions; it does not author SQL. This principle, constrained menus over free-text intent, generalizes to every plugin: shell access, file access, HTTP, code execution, MCP tools.