---
title: "Review agent settings like code · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/review-agent-config
id: AID-30
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 920
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Review agent settings like code

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-30
- Level: Required
- Chapter: [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)
- Rule: Treat instruction files, agent settings, hooks and rule folders as code that can run. Review every change to them and scan them for hidden text.
- Check: A script fails the build when an instruction or settings file holds invisible or direction-changing characters. The code owners file covers every agent file.
- Risk: An account or system taken over
- How: A poisoned instructions file can steer an agent without showing anything to a person. Attackers hide orders in invisible Unicode characters. Project settings can also start hooks and tool servers when a session opens. List these files in the code owners file, including skills, commands and MCP server settings such as `.mcp.json`. Open repositories you do not trust only in a sandbox, and read their agent files first. The same care applies to tools and servers, as [Allow only reviewed tools and servers](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```bash
LC_ALL=C.UTF-8 grep -rlP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{2066}-\x{2069}\x{FEFF}\x{E0000}-\x{E007F}]' \
  AGENTS.md CLAUDE.md .claude .cursor .github/copilot-instructions.md .github/instructions .mcp.json 2>/dev/null && exit 1 || exit 0
```

## Sources

- [UTS #55: Unicode Source Code Handling](https://www.unicode.org/reports/tr55/)
- [CVE-2021-42574 (Trojan Source)](https://www.cve.org/CVERecord?id=CVE-2021-42574)

## Related rules

- AIF-73 [Connect product agents only to tools and servers on a reviewed list](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md) in AI features
- AID-75 [Read every tool description and allow only the tools the task needs](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-tool-review.md) in AI-assisted development
- AID-57 [Keep project skills in the repository and review them like code](https://agentwranglers.se/playbook/ai-assisted-development/agent-skills/project-skills-in-repo.md) in AI-assisted development
- DOC-18 [Put a stop before every destructive step in a runbook](https://agentwranglers.se/playbook/documentation/docs-for-coding-agents/destructive-step-stops.md) in Documentation

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/review-agent-config">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Next: [Open unknown repositories in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/untrusted-repositories.md)
- [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)