[squad] Implement #53520: Review prompt-generation safety and input handling - #53770
Closed
github-actions[bot] wants to merge 1 commit into
Closed
[squad] Implement #53520: Review prompt-generation safety and input handling#53770github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
Documents risks and required guardrails for free-text task-description handling, prompt rendering/escaping, and the shared wizard JSON model's trust boundary for future reuse. Closes #53520 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
pelikhan
marked this pull request as ready for review
August 18, 2026 17:19
github-actions
Bot
added
the
closed:unknown
Contributor
Author
|
✅ Test Quality Sentinel completed test quality analysis. No test files were added or modified in this PR. Test Quality Sentinel skipped. This PR only modifies documentation (docs/security-review-wizard-prompt-generation.md).
|
Contributor
There was a problem hiding this comment.
Pull request overview
Documents a focused security review of wizard prompt generation, rendering safety, and future JSON model trust boundaries.
Changes:
- Assesses free-text prompt-integrity risks and safe DOM rendering.
- Documents validation gaps and future ingestion guardrails.
- Adds a required-guardrails checklist.
Show a summary per file
| File | Description |
|---|---|
docs/security-review-wizard-prompt-generation.md |
Records security findings and recommended mitigations. |
Review details
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Balanced
Comment on lines
+81
to
+86
| ## Guardrails required before merge | ||
|
|
||
| - [ ] Document that task-description text is untrusted user input, is copied verbatim into the generated prompt, and should not include secrets. | ||
| - [ ] Document that wizard-generated prompt text is plain text only and must not be rendered with `innerHTML`/unsafe HTML sinks without sanitization review. | ||
| - [ ] Document that `docs/src/data/wizard-data-model.json` is trusted static repo content in the docs implementation, but future CLI/server/plugin consumers must treat equivalent model JSON and `frontmatter` fragments as untrusted input. | ||
| - [ ] Add or track a reasonable maximum length for free-text task details before this ships broadly, to prevent oversized prompt output and reduce abuse potential. |
Comment on lines
+64
to
+67
| - Before merge, document that `docs/src/data/wizard-data-model.json` is trusted static repository content for the docs wizard only; future consumers must not assume equivalent JSON is trusted. | ||
| - Document that any CLI/server consumer loading model data from disk, network, or plugins must validate against the full JSON Schema, enforce size limits, and treat `frontmatter` fragments as untrusted structured data until merged under an allowlisted policy. | ||
| - Future generators should avoid prototype-polluting or surprising merge behavior when handling free-form objects such as `frontmatter`; prefer schema validation plus safe deep-merge logic that rejects dangerous keys and unknown top-level fields. | ||
| - Consider strengthening runtime validation in a follow-up hardening issue if/when the shared model is consumed outside the current checked-in docs path. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Focused security/design review (Kujan, Security Engineer) on user-supplied text flowing into generated wizard prompt content, client-side rendering, and the shared wizard JSON catalog's trust boundary, per issue #53520 (epic #53498).
Reviewed:
docs/src/components/Wizard.astro— free-text task description handling, prompt renderingdocs/src/lib/wizard/model.ts/validation.ts— shared JSON data model + validationmodel.test.js,docs/tests/wizard.spec.ts)Findings (new
docs/security-review-wizard-prompt-generation.md)textContent) but is a downstream prompt-integrity concern by design (user text flows verbatim into the generated prompt). No current length cap.textContent); noinnerHTML/unsafe HTML sinks found in the wizard component.wizard-data-model.jsonis trusted static repo content today, but the spec anticipates future CLI/server reuse; the runtime validator does not enforceadditionalProperties: false, ID uniqueness, referential integrity, or size limits needed once the model may come from less-trusted sources.validateModel()is a shape validator for checked-in docs content, not a security boundary; needs strengthening before any external ingestion.Includes a "Guardrails required before merge" checklist and a "Not in scope" section clarifying this is a hardening/documentation pass, not functional QA.
Validation
node docs/src/lib/wizard/model.test.js— 14/14 passed.Closes #53520
Add this agentic workflow to your repo
To install this agentic workflow, run