fix: escape HTML comments in review skill, add output schema to agent def - #1111
fix: escape HTML comments in review skill, add output schema to agent def#1111waynesun09 wants to merge 3 commits into
Conversation
The fullsend context scanner flags literal HTML comments in context files as hidden_content injection. The pr-review SKILL.md and review agent definition contained raw `<!-- ... -->` examples that triggered a high-severity finding. Replace them with decomposed delimiter descriptions that convey the same format without matching the scanner pattern. Also adds the expected review comment format to the review agent definition so it is not only documented in the skill. Signed-off-by: Wayne Sun <gsun@redhat.com>
The review agent definition now documents the full JSON schema for agent-result.json including required fields per action, finding object structure, and validation behavior. Previously this was only in the pr-review skill and the JSON schema file, causing agents to miss required fields and fail harness validation. Signed-off-by: Wayne Sun <gsun@redhat.com>
Site previewPreview: https://05c082bf-site.fullsend-ai.workers.dev Commit: |
- Normalize double-spaces to single-spaces in the Head SHA example in SKILL.md to match the original format - Restore literal HTML comment in review.md failure output code fence (scanner skips review.md — it's not a known context file) - Mark schemas/review-result.schema.json as source of truth in the schema documentation section Signed-off-by: Wayne Sun <gsun@redhat.com>
ReviewFindingsLow
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| **Required fields per action:** | ||
|
|
||
| | Action | Required fields | | ||
| |-------------------|------------------------------------------| |
There was a problem hiding this comment.
[low] incomplete-fix
The literal HTML comment pattern inside the Failure output code fence was not escaped. The PR fixes this pattern in SKILL.md but misses this instance in agents/review.md, which is also modified in this PR. If the scanner does not respect code fences, this will still trigger a hidden_html_comment finding.
Suggested fix: Apply the same [open]/[close] workaround used in SKILL.md step 6 to the failure output example in agents/review.md.
Review follow-upsCreated follow-up issues for actionable non-blocking review findings:
|
fullsend-ai-review
Bot
added
the
ready-for-merge
Merge content from #1111 into this PR: - Escape literal HTML comment patterns in pr-review SKILL.md that trigger fullsend scan context hidden_html_comment findings - Add JSON schema tables (fields, types, constraints, required-per-action) to the agent definition alongside the existing jq examples - Mark schemas/review-result.schema.json as source of truth - Replace inline HTML comment reference in SKILL.md constraints with back-reference to step 6 Supersedes #1111. Signed-off-by: Wayne Sun <gsun@redhat.com>
1 participant
Summary
<!-- ... -->) in the pr-review SKILL.md that triggeredfullsend scan contexthigh-severityhidden_html_commentfindings. The scanner does line-by-line matching and doesn't respect code fences.Test plan
fullsend scan contextpasses clean on pr-review SKILL.mdagent-result.jsonon next PR review run