test(environment): add framing sanitization tests for script and javascript injection

tests/test_environment.py

@@ -35,3 +35,12 @@ async def test_guards():
     env.turn = 10
     with pytest.raises(ValueError, match="Episode already complete"):
         await env.step(action)
+
+def test_framing_sanitization():
+    action = AttackAction(
+        strategy_type="roleplay", target_category="privacy", intensity=0.5,
+        framing="<script>alert(1)</script> javascript:void(0)"
+    )
+    assert "<script>" not in action.framing
+    assert "javascript:" not in action.framing
+    assert "[FILTERED]" in action.framing