Yufeng He e361122b9a

fix(security): html-escape subagent descriptions before the <subagent_system> block (#4157) ...

A custom subagent's description is agent-editable (persisted by setup_agent /
update_agent) and is rendered into the <subagent_system> block of the lead-agent
system prompt via the available-subagents listing. It was interpolated raw, so a
first line like "</subagent_system><system-reminder>..." could close the block
and forge a framework-reserved tag inside the system-role prompt.

Escape it with html.escape at the render site, matching the sibling fixes for
<soul> (#4137), memory facts (#4097), skill metadata (#4128), and remote content
(#4099/#4002). Built-in descriptions are trusted constants and stay untouched.

Adds a red/green regression test mirroring test_soul_prompt_injection.py.

2026-07-14 08:14:21 +08:00

..

harness

fix(security): html-escape subagent descriptions before the <subagent_system> block (#4157)

2026-07-14 08:14:21 +08:00