Security: Unsafe deserialization of LLM/Agent output

## Security Findings Report

We scanned this repository using [Inkog](https://inkog.io), an AI security scanner, and identified **1 HIGH severity vulnerability** related to unsafe deserialization.

### Summary

- **1 HIGH severity** unsafe deserialization of LLM/Agent output
- **Governance Score:** 83/100
- **Issue:** Human Oversight MISSING

### Findings

| Severity | Issue | Location | Notes |
|----------|-------|----------|-------|
| HIGH | Unsafe Deserialization of LLM/Agent Output | `spans.py:15` | Taint source: external_data |

### Details

The vulnerability involves deserializing data from an external source (LLM or agent output) without proper validation. This can lead to:
- Code execution vulnerabilities
- Data integrity issues
- Potential for malicious payload injection

### How to Reproduce

You can verify these findings by running Inkog yourself:

```bash
npx -y @inkog-io/cli scan . -deep
```

### Recommendations

1. **Validate before deserializing:** Implement strict schema validation before deserializing any external data.
2. **Use safe deserialization methods:** Consider using safer alternatives like JSON schema validation or type checking.
3. **Sandbox execution:** If deserialized data is used in execution contexts, ensure proper sandboxing.
4. **Human oversight:** For a production-grade governance score, consider adding human-in-the-loop controls for critical operations.

### Learn More

For detailed remediation guidance and best practices for securing AI applications, visit [inkog.io](https://inkog.io).

---

*This report was generated to help improve the security of your project. We hope you find it useful!*