Summary
suggest_improvement validates description / context length, then composes a GitHub issue title by truncating the (scrubbed) description to 60 chars and prepending [AI Suggestion] {category}: . The title itself is never sanitized for markdown link / image syntax. A caller can craft a description that begins with ](https://example.com/x) ![spoofed] so the rendered issue title in lists / notifications looks like a phishing link or breaks the surrounding markdown layout.
This is distinct from #1409 (which targets ScrubInlineCode for the body) — the title path skips that scrub.
Where
src/CodeIndex/Cli/GitHubIssueReporter.cs:119-123 (title composition)src/CodeIndex/Cli/GitHubIssueReporter.cs (ScrubInlineCode applied to body, not title)
Suggested approach
Run the same scrubber over the title slice; in addition, strip [, ], (, ), `, and leading whitespace from the title source before prepending the prefix. Cap the category name length defensively (today the enum is finite, but a string-typed category in the future would be unbounded).
Summary
suggest_improvementvalidates description / context length, then composes a GitHub issue title by truncating the (scrubbed) description to 60 chars and prepending[AI Suggestion] {category}:. The title itself is never sanitized for markdown link / image syntax. A caller can craft a description that begins with](https://example.com/x) ![spoofed]so the rendered issue title in lists / notifications looks like a phishing link or breaks the surrounding markdown layout.This is distinct from #1409 (which targets
ScrubInlineCodefor the body) — the title path skips that scrub.Where
src/CodeIndex/Cli/GitHubIssueReporter.cs:119-123(title composition)src/CodeIndex/Cli/GitHubIssueReporter.cs(ScrubInlineCode applied to body, not title)Suggested approach
Run the same scrubber over the title slice; in addition, strip
[,],(,),`, and leading whitespace from the title source before prepending the prefix. Cap the category name length defensively (today the enum is finite, but a string-typed category in the future would be unbounded).