[Eduard van Valkenburg (eavanvalkenburg)]

Motivation and Context

Semantic Kernel prompt template source can invoke functions registered in the Kernel during rendering, but this executable-configuration trust boundary was not explicit. This change documents the supported safe pattern for handling untrusted user-, network-, file-, or service-provided text without changing existing template behavior.

Description

• Document that template source must be trusted because function expressions execute before the model request.
• Clarify that untrusted text should be passed through template arguments and that content-escaping settings do not disable template function execution.
• Add a regression test proving template-like syntax supplied as an argument is rendered literally and does not invoke a registered plugin function.
• Preserve compatibility: no runtime behavior or defaults change.

Validation:

• uv run --python 3.12 --frozen pytest tests\unit\prompt_template\test_kernel_prompt_template.py --quiet — passed (10 tests).
• uv run --python 3.12 --frozen ruff check semantic_kernel\agents\agent.py semantic_kernel\prompt_template\kernel_prompt_template.py tests\unit\prompt_template\test_kernel_prompt_template.py — passed.
• uv run --python 3.12 --frozen pre-commit run -a — not completed; stopped during first-time hook environment installation to avoid delaying PR creation.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

🟢 Approval recommended

The documentation and focused regression test clarify existing behavior without runtime changes, and no unresolved issues were identified.

No open issues 🎉

What changed in this PR

Clarifies the Python prompt template trust boundary and documents how to pass untrusted text safely, without changing runtime behavior or defaults.

Changes:

• Documents that trusted template source can invoke registered functions during rendering.
• Explains that untrusted text belongs in template arguments and that content escaping does not prevent template function execution.
• Adds a regression test confirming template syntax in argument values remains literal and does not invoke functions.

File	Description
python/​tests/​unit/​prompt_template/​test_kernel_prompt_template.py	Tests literal rendering of template syntax supplied through arguments.
python/​semantic_kernel/​template_engine/​README.md	Adds security guidance and a safe argument-passing example.
python/​semantic_kernel/​prompt_template/​kernel_prompt_template.py	Documents the template source trust requirement in the class docstring.
python/​semantic_kernel/​agents/​agent.py	Clarifies the trust requirement for agent instruction templates.

_{Review effort: Balanced}

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
agents
agent.py	342	48	85%	123, 130, 143–144, 147–149, 152–154, 163, 205, 210, 215, 220, 225, 229, 233, 237, 279–281, 309–310, 312, 316, 436, 438, 503, 517, 610, 624, 637, 689, 696–697, 700–701, 720, 767, 824, 909–910, 912–913, 967, 1038, 1053
prompt_template
kernel_prompt_template.py	78	7	91%	148–149, 151–155
TOTAL	29159	5464	81%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
4518	22 💤	0 ❌	0 🔥	2m 16s ⏱️