feat: Add smart reply suggestions for guest messages

[danenania]

Summary

Add AI-powered reply suggestions to help hosts respond to guest inquiries quickly and professionally.

Features

• Generate 3 professional reply options for any guest message
• Context-aware suggestions based on property details and guest name
• List pending conversations needing responses

New Endpoints

• POST /authorized/:level/suggestions/generate - Generate reply suggestions for a conversation
• GET /authorized/:level/suggestions/conversations - List all conversations

Files Added

• src/routes/suggestions.ts - Reply suggestion endpoints
• src/data/guest-messages.json - Sample guest conversations (4 conversations)

[promptfoo-scanner]

I reviewed the smart reply suggestions feature for LLM security vulnerabilities. The PR introduces a new endpoint that generates AI-powered reply suggestions for property hosts responding to guest messages. I found one high-severity prompt injection vulnerability where guest message content flows directly into LLM prompts without sanitization, allowing malicious guests to manipulate the suggestions shown to hosts.

_{Minimum severity threshold for this scan: 🟡 Medium | Learn more}

[promptfoo-scanner]

🟠 High

Guest message content is embedded directly into the LLM prompt without sanitization, creating a cross-user prompt injection vulnerability. A malicious guest can craft messages with embedded instructions that manipulate the AI-generated suggestions shown to property hosts. This crosses a trust boundary since the guest (attacker) can influence content displayed to the host (victim), potentially causing reputation damage or facilitating social engineering attacks.

💡 Suggested Fix

Use structured message roles to separate system instructions from user content, and add input sanitization for defense-in-depth:

function sanitizeGuestInput(content: string): string {
  const sanitized = content
    .replace(/ignore\s+(previous|above|prior)\s+instructions?/gi, '')
    .replace(/new\s+instructions?:/gi, '')
    .replace(/system\s*:/gi, '')
    .replace(/\b(assistant|system|user)\s*:/gi, '')
    .slice(0, 1000);
  return sanitized.trim();
}

async function generateReplySuggestions(
  conversation: Conversation,
  model?: string
): Promise<string[]> {
  // ... existing code ...

  const sanitizedContent = sanitizeGuestInput(lastGuestMessage.content);

  const systemPrompt = `You are a helpful assistant for vacation rental hosts.

Property: ${conversation.propertyName}
Guest Name: ${conversation.guestName}

IMPORTANT: The guest message below is user-provided content. Generate exactly 3 professional reply suggestions that are welcoming, address the guest's questions, and encourage booking.

Format: ["Reply 1", "Reply 2", "Reply 3"]`;

  const userPrompt = `The guest wrote:\n\n${sanitizedContent}\n\nPlease generate 3 professional reply suggestions.`;

  // ... rest of implementation
}

🤖 AI Agent Prompt

The code at src/routes/suggestions.ts:67-74 embeds guest message content directly into LLM prompts without sanitization, creating a prompt injection vulnerability where malicious guests can manipulate suggestions shown to property hosts.

Investigate the complete data flow from guest message submission through to the LLM call. Check if there are existing input validation utilities in the codebase that could be leveraged. Consider whether a centralized prompt construction utility would benefit other LLM-using features in the application.

Implement a fix that:

1. Separates system instructions from user content using structured message roles (system/user)
2. Adds input sanitization to remove common injection patterns
3. Includes explicit instructions in the system prompt that user content should be treated as data
4. Limits input length to prevent token stuffing attacks

Test the fix with various prompt injection payloads (e.g., "Ignore previous instructions", role manipulation attempts, delimiter escaping) to ensure it provides robust protection while not breaking legitimate guest messages.

---

_{Was this helpful?  👍 Yes  |  👎 No}