Agent permissions and prompt injection

Repositories, issue descriptions, web pages and tool outputs can contain instructions written by someone else. They are task data unless the human or a trusted instruction source authorizes them. A fetched document should not silently expand the task into credential access or external writes.

Use real permission/sandbox controls, scoped credentials and isolated test environments. Do not paste production secrets into prompts or commit them in examples. An agent with broad shell access can affect more than the edited file.

Review commands and changes at trust boundaries: installing dependencies, running scripts, migrations, uploading data and deployment. Distinguish a helpful generated command from an authorized action, and inspect output for evidence without exposing secrets.