Skip to content

[BUG] js-quickadd fences inside AI prompt templates execute on every AI call - needs a deliberate look #1622

Description

@chhoumann

Describe the behavior (deliberate-look request, possibly working as intended)

A ```js quickadd fence inside an AI prompt template note executes on every AI call. The template goes through CompleteFormatter.formatFileContent, whose first pass is replaceInlineJavascriptInString - so any inline-script fence in the template runs as arbitrary JS each time the AI command fires.

This is live behavior today, not hypothetical.

Why it deserves a deliberate look

  • Prompt templates read as "text sent to the model"; users (and package reviewers) may not expect them to be a code-execution surface.
  • Prompt templates can arrive via package import. The package preview flags scripts and commands, but a JS fence inside a referenced template note is subtler than either.
  • If it IS intended (parity with Template choices), it should be documented explicitly on the AI Assistant docs page and considered in the package-preview trust surface. If it is not intended, the AI path should run a reduced pass list (the FormatDisplayFormatter idiom - see the [FEATURE] Decide whether AI system prompts should support QuickAdd format syntax #1572 analysis for the safe-pass sketch).

Found during the #1571/#1572 triage investigation.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions