validate robots' untrusted return values properly