No static analysis tool for LangGraph and CrewAI code that flags prompt injection paths to consequential tool calls

LangGraph, CrewAI, AutoGen, and similar frameworks wire untrusted external content (web scrapes, email bodies, document text) directly into LLM context that controls tool calls with real-world consequences (file writes, API calls, email sends). There is no static analyzer that reads Python agent code and flags the specific dataflow paths where untrusted inputs can reach high-consequence tools without an explicit trust boundary check. Simon Willison catalogued the design patterns that prevent this (dual LLM architecture, taint tracking, deny-by-default tool scoping) but notes none of them are implemented as automated tooling. The Google Antigravity attack (768+215 HN pts, Nov 2025) demonstrated live data exfiltration from a production AI coding agent via exactly this attack surface. The DB has one MCP-specific scanner but nothing that audits general LangGraph/CrewAI/AutoGen agent code for trust boundary violations.