AI-Assisted Secure Coding (Appendix C) · AI Code-Review & Assistant Bot Hardening
Review bots return structured output only
Verify that AI review and assistant bots emit only structured, schema-validated output (JSON with an allow-list of fields and actions). Any free-form output is treated as untrusted and never executed as a command, a query, a shell snippet, or a workflow step.
OWASP AISVS v1.01, requirement AC.11.3
In plain English
A review bot should produce only structured output that is validated against a schema, with a fixed list of fields and actions. Anything free-form is untrusted text for display. It must never be run as a command, a query, a shell snippet or a workflow step.
What good looks like
- Bot output follows a strict schema, such as JSON with an allow-list of fields.
- Actions are chosen from a fixed list and validated by the integration.
- Free text is displayed only, with its formatting sanitised.
- Nothing from the bot's output is interpolated into a shell command or workflow expression.
How teams usually do it
- Structured output mode on the model, plus validation in the integration before any action (see 7.1.1).
- Passing bot output to later workflow steps through files or environment variables, and never through inline expression interpolation in a run: step.
- Rendering comments with links and images restricted (see 7.3.3).
Suggested evidence
- The schema and integration code.
- A test where the bot's output contains a shell command and nothing runs.
Common mistakes
- Piping bot suggestions into a shell.
- Interpolating model output into a workflow script, which is command injection.
- Auto-applying the bot's suggested patches without review.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.