Agent Wranglers

AID-30Required

Review agent settings like code

Treat instruction files, agent settings, hooks and rule folders as code that can run. Review every change to them and scan them for hidden text.

By Agent Wranglers. Updated .

How to do it

A poisoned instructions file can steer an agent without showing anything to a person. Attackers hide orders in invisible Unicode characters. Project settings can also start hooks and tool servers when a session opens. List these files in the code owners file, including skills, commands and MCP server settings such as .mcp.json. Open repositories you do not trust only in a sandbox, and read their agent files first. The same care applies to tools and servers, as Allow only reviewed tools and servers says.

Examples

Shell example

LC_ALL=C.UTF-8 grep -rlP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{2066}-\x{2069}\x{FEFF}\x{E0000}-\x{E007F}]' \
  AGENTS.md CLAUDE.md .claude .cursor .github/copilot-instructions.md .github/instructions .mcp.json 2>/dev/null && exit 1 || exit 0

How to check

A script fails the build when an instruction or settings file holds invisible or direction-changing characters. The code owners file covers every agent file.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/review-agent-config">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.