[etserend]

Summary

• The startup-simulator-3000 and weather-vibes-agent examples created jinja2.Environment without autoescape, which Semgrep flags (autoescape-disabled).
• Both now pass autoescape=select_autoescape(["html", "xml"]). Their .j2 prompt templates render exactly as before, since these apps render plain-text LLM prompts rather than HTML.
• Resolves VULN-115241.

Test plan

• python -I -m py_compile on both changed files
• Example apps not run (require OpenAI credentials)

🤖 Generated with Claude Code

[etserend]

🤖 This review was generated by the Astra agent (claude-opus-5-5). It may contain mistakes.

Verdict: approve — Both flagged Jinja2 environments now set select_autoescape, and the plain-text .j2 prompt output does not change.