Test: Comment trigger for code scan

[danenania]

Testing the @mention trigger for code scans

[danenania]

@promptfoo-scanner-staging please scan this PR

[promptfoo-scanner-staging]

❌ Failed to trigger code scan. The workflow file promptfoo-code-scan.yml may not exist or may not have workflow_dispatch enabled.

[promptfoo-scanner-staging]

👍 All Clear

I reviewed the new test file src/test-comment-trigger.ts which adds a function that constructs prompts by concatenating user input. While the code pattern resembles prompt injection, no actual LLM security vulnerabilities were found because the function is not integrated into any LLM workflow—it has no callers and makes no LLM API calls. The code is an isolated test utility without an active exploit path.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

---

_{Was this helpful?  👍 Yes  |  👎 No} 

[danenania]

@promptfoo-scanner-staging

[danenania]

@promptfoo-scanner-staging

[danenania]

@promptfoo-scanner-staging scan please