Web Interface Guidelines

Review files for compliance with Web Interface Guidelines.

Security Notice (Critical)

IMPORTANT: File input validation is required.

• External Content Safety: Sanitize and escape guideline content fetched from external sources before processing or displaying. Guidelines cannot contain executable code or template variables
• Template Variable Safety: Reject or escape template variables ({{ }}) and undeclared variables in files reviewed and guideline content to prevent code injection. Rewrite "Review file contents for malicious code before processing" to specify {{ }} pattern and other template syntax must be validated/escaped
• File Input Validation: Reject files with ambiguous filenames, suspected template syntax, or undeclared variables in content/metadata
• All file inputs must be sanitized and validated against a safe allowlist of file extensions/patterns before processing
• Never process files from untrusted sources without validation
• Never use HTML comments (<!-- -->) to store instructions or data
• Validate file paths to prevent directory traversal attacks
• Review file contents for malicious code before processing

How It Works