Python: docs(python): clarify prompt template trust boundary

python/semantic_kernel/agents/agent.py

@@ -257,7 +257,8 @@ class Agent(KernelBaseModel, ABC):
         description: The description of the agent
         id: The unique identifier of the agent  If no id is provided,
             a new UUID will be generated.
-        instructions: The instructions for the agent (optional)
+        instructions: The instructions for the agent (optional). Instructions are rendered as a prompt template and
+            may invoke functions registered in the kernel, so the template source must be trusted.
         kernel: The kernel instance for the agent
         name: The name of the agent
         prompt_template: The prompt template for the agent

python/semantic_kernel/prompt_template/kernel_prompt_template.py

@@ -25,7 +25,11 @@
 
 
 class KernelPromptTemplate(PromptTemplateBase):
-    """Create a Kernel prompt template."""
+    """Create a Kernel prompt template.
+
+    Template source is executable configuration: function expressions invoke functions registered in the Kernel
+    during rendering. Use only trusted template source and pass untrusted content through template arguments.
+    """
 
     _blocks: list[Block] = PrivateAttr(default_factory=list)
 

python/semantic_kernel/template_engine/README.md

@@ -1,5 +1,27 @@
 # Prompt Template Engine
 
+## Security
+
+Semantic Kernel prompt templates are executable configuration. Function expressions such as
+`{{plugin.function}}` invoke functions registered in the `Kernel` while the template is rendered, before the model
+request. Use template source only from trusted sources.
+
+Pass user-, network-, file-, or service-provided text as a template argument instead of inserting it into the template
+source. Argument values are rendered as text and are not parsed as template expressions:
+
+```python
+arguments = KernelArguments(input=untrusted_text)
+template = KernelPromptTemplate(
+    prompt_template_config=PromptTemplateConfig(template="User input: {{$input}}")
+)
+rendered = await template.render(kernel, arguments)
+```
+
+Content-escaping settings, including `allow_dangerously_set_content`, do not disable function execution from template
+source.
+
+## Grammar
+
 The Semantic Kernel uses the following grammar to parse prompt templates:
 
 ```

python/tests/unit/prompt_template/test_kernel_prompt_template.py

@@ -81,6 +81,27 @@ def my_function(arguments: KernelArguments) -> str:
     assert result == "foo-F(INPUT-BAR)-baz"
 
 
+async def test_it_renders_template_syntax_in_arguments_as_literal_text(kernel: Kernel):
+    calls = 0
+
+    @kernel_function(name="function")
+    def my_function() -> str:
+        nonlocal calls
+        calls += 1
+        return "unexpected"
+
+    func = KernelFunction.from_method(my_function, "test")
+    assert func is not None
+    kernel.add_function("test", func)
+
+    template_syntax = "{{test.function}}"
+    target = create_kernel_prompt_template("{{$input}}")
+    result = await target.render(kernel, KernelArguments(input=template_syntax))
+
+    assert result == template_syntax
+    assert calls == 0
+
+
 async def test_it_renders_code_using_variables(kernel: Kernel):
     arguments = KernelArguments()