# AI Agent Output > Watch @humanspeak/svelte-markdown render streaming HTML from a simulated AI agent, with live sanitization blocking unsafe URLs and event handlers. **Source:** [https://markdown.svelte.page/examples/agent-output](https://markdown.svelte.page/examples/agent-output) **Markdown mirror:** [https://markdown.svelte.page/examples/agent-output.md](https://markdown.svelte.page/examples/agent-output.md) --- This mirror preserves the prose, implementation notes, and runnable Svelte source behind the live example page. ## FIG-001: agent output. A simulated agent streams a PR-review response mixing legitimate rich HTML (verdict box, findings table, real link) with deliberate XSS attempts — `javascript:` URLs, `onerror` / `onclick` / `onsubmit` handlers, a `vbscript:` protocol, a form posting to `javascript:`. Watch the source, the sanitized render, and the audit log fill in together. **Metadata:** tag: `AGENT` | sanitize: `url + attrs` ### Notes - Sanitization happens at the `Parser` layer — custom renderers and snippets cannot bypass it. - The URL allowlist covers `javascript:`, `vbscript:`, `data:` (where unsafe), and other dangerous protocols. - Inline event handlers (`onclick`, `onerror`, `onsubmit`, …) and `srcdoc` are stripped before render. - Streaming-aware — every chunk is sanitized as it arrives, not after the document completes. ### Source #### AgentConsole.svelte Source file: [src/lib/examples/agent-output/demos/AgentConsole.svelte](https://github.com/humanspeak/svelte-markdown/blob/main/docs/src/lib/examples/agent-output/demos/AgentConsole.svelte) ```svelte
file · agent-output.svelte chunks {chunkIndex}/{chunks.length || '—'} events {sanitizationLog.length} {#if isActive}● LIVE{:else if streamSource}✓ DONE{:else}○ IDLE{/if}
SRC / AGENT STREAM raw text in 
{streamSource ||
                    '// agent response will arrive here word by word.'}
OUT / RENDERED sanitized live
{#if !streamSource && !isActive}

click "start" to render the simulated agent response.

{/if}
BLOCKED / SANITIZATION LOG wraps defaultSanitizeUrl & defaultSanitizeAttributes URL ATTR
{#if sanitizationLog.length === 0}

nothing blocked yet — the log fills in as malicious payloads stream in.

{:else}
    {#each sanitizationLog as event, i (i)}
  1. <{event.tag}> {event.kind === 'url' ? 'url blocked' : 'attribute stripped'} {event.detail} {#if event.replacement} → {event.replacement} {/if}
    2. {/each}
{/if}
```