ROADMAP-02 — P0 — SQL tool injects cell values into markdown unescaped (stored prompt injection) #94

Series: ROADMAP — filed from the 2026-10-27 whole-project assessment · Backlog task: M14-T02 · Priority: P0 · Effort: extra small

Problem

format_rows_as_markdown inserts SQL result cell values into the markdown table verbatim. A cell containing |, newlines or control characters can forge extra table rows and smuggle instructions into the prompt — classic stored prompt injection. This is the one remaining prompt-hygiene gap in an otherwise locked-down tool (the statement lexer and role isolation are solid).

Evidence

• agentkit/tools/builtin/sql_readonly.py:405–416 — format_rows_as_markdown
• The sql_readonly tool output enters history un-changed (executor truncates length only, agentkit/tools/executor.py)

Suggested fix / acceptance criteria

• Escape |, newlines and control characters per cell (e.g. \u2063-style substitution or \| / \n literals)
• Truncate oversized cells to a per-cell bound consistent with TOOL_OUTPUT_MAX_CHARS
• Unit tests inject adversarial DB values (| ignored instructions, newline smuggling) and assert row count / sanitized output

Suggested branch / commit

fix/sql-markdown-escaping · fix(tools): escape SQL result cells before markdown formatting