This is true of any webscraper though, you need to santitize any content you collect from the web. If a person wanted a scraper to get something different from the browser, they could easily use UA sniffing to do so. (I've seen it this done a few times.)

Asking GPT to create JSON and then validating the JSON is one piece of that process, but before someone deserialized that JSON and executed INSERT statements w/ it, they should do whatever they usually would do to sanitize that input.