feat(models): add framing sanitizer validator to strip injection patterns

models.py

@@ -1,5 +1,5 @@
 from enum import Enum
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 
 class StrategyType(str, Enum):
     ROLEPLAY        = "roleplay"
@@ -22,3 +22,11 @@ class AttackAction(BaseModel):
     target_category: TargetCategory
     intensity:       float = Field(ge=0.0, le=1.0)
     framing:         str   = Field(max_length=500)
+
+    @field_validator("framing")
+    @classmethod
+    def sanitize_framing(cls, v: str) -> str:
+        dangerous = ["<script>", "javascript:", "onerror="]
+        for pattern in dangerous:
+            v = v.replace(pattern, "[FILTERED]")
+        return v.strip()