fix: CSM-001 done

test/bds/ai_test.exs

@@ -285,6 +285,28 @@ defmodule BDS.AITest do
     :ok
   end
 
+  test "model_capabilities does not create atoms from unknown capability keys" do
+    before = :erlang.system_info(:atom_count)
+
+    malicious_caps =
+      Jason.encode!(%{
+        "supports_attachment" => true,
+        "supports_tool_calls" => false,
+        "disables_reasoning" => false,
+        "csm001_fictive_#{:erlang.unique_integer()}" => true,
+        "another_unknown_#{:erlang.unique_integer()}" => 42
+      })
+
+    :ok = BDS.AI.SettingsStore.put_setting("ai.model_capabilities.csm-test-model", malicious_caps)
+
+    result = BDS.AI.Catalog.model_capabilities("csm-test-model")
+    assert result.supports_attachment == true
+    assert result.supports_tool_calls == false
+
+    after_count = :erlang.system_info(:atom_count)
+    assert after_count == before
+  end
+
   test "put_endpoint, get_endpoint, and delete_endpoint manage encrypted endpoint settings" do
     assert {:ok, endpoint} =
              BDS.AI.put_endpoint(