fix(ai-security): unscoped LLM prompts allow prompt injection and API abuse

[rhea-security]

Automated fix generated by Rhea for a MEDIUM AI_SECURITY finding:

Unscoped LLM prompts allow prompt injection and API abuse

Hardening the three Groq call sites with system prompts, delimited untrusted input, and tighter generation settings.

Summary

Hardened all three Groq call sites against prompt injection by adding instruction hierarchy and untrusted-data framing.

Changes

• src/commands/code/suggest.ts: System policy for code-only advice; user payload in <user_code>; temperature 0.2.
• src/commands/code/run.ts: System policy for explain/fix; code and stderr in delimited tags; temperature 0.2 and max_completion_tokens: 640.
• src/commands/math/math-breakdown.ts: System policy for math-only breakdowns; expression in <user_expression>; temperature 0.2.

Why

Unscoped single-user messages let injected text override the task. System messages plus delimited data reduce injection risk and keep completions on-task without changing command UX.

verifyStagedEdits only reported missing ambient types/deps (no node_modules in the limited checker), not issues from these edits.

---

🤖 Generated by Rhea — review before merging.

[beetle-ai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @beetle command.

⚙️ Settings

Severity Threshold: Medium — Balanced feedback — medium and high severity issues only. — Change in Settings
Custom Rules: Define your own review rules — Set Custom Rules
PR Summary: Configure PR summary — Change in Settings

📖 User Guide

• Once repos are connected, PR analysis is automatically enabled. You can disable analysis for this repo from beetleai.dev/analysis
• Comment @beetle on any PR to start analysis manually
• Comment @beetle stop to stop any ongoing analysis

---

Follow us: Beetle · X · LinkedIn

[devhub-bot]

Note

Linting checks passed successfully 🎉

All formatting and code quality checks are clean.

You're good to merge 🚀

[calebephrem]

I didn't get how this is prompt injection fix but ts a nice pr