11Secure a coding agent that can run shell commands on a developer machine or in CI.▼hardNew◆ premiumTreat repository code and shell execution as part of the threat model. Define reachable files, credentials, services and publication paths, then verify the actual sandbox and CI handoff rather than trusting command names.Open full answer →
40How do AGENTS.md, rules files and editor or MCP config in a repository become an attack path against coding agents?▼hardNew◆ premiumRepository instructions can influence a model; configuration can change execution. Trace creation, replacement and startup before deciding where approval must hold.Open full answer →
47How is an agent skill from a public marketplace different from an MCP server as a risk, and how would you govern skills?▼hardNewAnthropicOpenAIMicrosoft◆ premiumA skill is instructions plus code that runs with the agent's own permissions, with no process boundary in between. The scored answer reviews it like software and like a prompt, because it is both.Open full answer →