## Lesson — Omit defensive XML escaping for prompt injection

**Tags:** security, curated
**Pattern:** \b(escapeXml|escapeHtml|encodeXml|formatXmlResponse)\s*\(
**Engine:** regex
**Scope:** packages/cli/**/*.ts, apps/cli/**/*.ts, **/cli/**/*.ts
**Severity:** error

Omit defensive XML escaping for prompt injection.
