Test: Comment trigger v2 (with workflow fix)

[danenania]

Testing comment trigger with updated workflow that includes PR checkout step

[danenania]

@promptfoo-scanner-staging scan

[danenania]

@promptfoo-scanner-staging scan again

[promptfoo-scanner-staging]

👍 All Clear

I reviewed this PR which adds a new test file containing a function that demonstrates a prompt injection pattern. While the code shows a classic anti-pattern (unsanitized user input concatenated into a system prompt), I traced the function through the codebase and found it has no callers and is not integrated into any LLM workflows. Since it cannot be exploited through normal application interfaces, no actionable security vulnerabilities were identified.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[promptfoo-scanner-staging]

👍 All Clear

I reviewed this PR for LLM security vulnerabilities and found that while the code demonstrates an insecure prompt construction pattern (unsanitized user input concatenated into a system prompt), it does not constitute an exploitable vulnerability. The function is not called anywhere in the codebase, makes no LLM API calls itself, and cannot be triggered through normal application interfaces.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[danenania]

@promptfoo-scanner-staging test check run

[promptfoo-scanner-staging]

👍 All Clear

This PR adds a new test file with a function that demonstrates a prompt injection vulnerability pattern. However, after thorough tracing of the codebase, I found that this function is not called anywhere and does not connect to any LLM API. Since there's no actual data flow or exploit path, no active security vulnerabilities were identified.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[danenania]

@promptfoo-scanner-staging check run fix test

[promptfoo-scanner-staging]

👍 All Clear

I reviewed the new test file that demonstrates prompt construction with user input interpolation. While the code shows a pattern that would be vulnerable if integrated into an LLM workflow, I found no exploitable security vulnerabilities because the function is not connected to any LLM API calls and has no active usage in the codebase.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[danenania]

@promptfoo-scanner-staging

[promptfoo-scanner-staging]

👍 All Clear

I reviewed this PR for LLM security vulnerabilities across prompt injection, data exfiltration, secrets/PII in prompts, insecure output handling, excessive agency, and jailbreak risks. The new test file adds a function that constructs prompts with user input, but it's not integrated into any application workflow and has no callers in the codebase.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[danenania]

@promptfoo-scanner-staging

[promptfoo-scanner-staging]

👍 All Clear

I reviewed the new test file for LLM security vulnerabilities. While the code demonstrates a prompt injection anti-pattern (unsanitized user input concatenated into prompts), it's not currently integrated with any LLM workflows and has no callers in the codebase, so there's no exploitable vulnerability at this time.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[danenania]

@promptfoo-scanner-staging

[promptfoo-scanner-staging]

👍 All Clear

I reviewed this PR which adds a test file containing a prompt construction function. While the code demonstrates a vulnerable pattern (concatenating user input directly into prompts), it's not currently integrated into any application code paths and has no callers in the codebase. As isolated test code with no actual data flow to LLMs, it doesn't present an exploitable vulnerability in its current state.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[danenania]

@promptfoo-scanner-staging

[promptfoo-scanner-staging]

👍 All Clear

I reviewed the PR and found that while the code exhibits a prompt injection pattern, it doesn't meet the criteria for a reportable vulnerability since the function has no callers and cannot be reached through any application interface.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No}