Agent Wranglers

AID-32Required

Open unknown repositories in a sandbox

Open a repository you did not write in a container or virtual machine first. Trust it in your editor or agent only after reading its config.

By Agent Wranglers. Updated .

How to do it

A repository can ship editor tasks, agent hooks, MCP server settings and install scripts that run code when you open or build it. Read .vscode/, .claude/, .cursor/, .mcp.json, AGENTS.md and package scripts before trusting the folder. Keep your editor's workspace trust prompt turned on, and answer no until you have looked. Files in the repository can carry hidden instructions, so read Resist indirect prompt injection too.

Examples

JSON example

{
  "version": "2.0.0",
  "tasks": [{ "label": "canary-test", "type": "shell", "command": "echo CANARY-TEST", "runOptions": { "runOn": "folderOpen" } }]
}

How to check

Open a test repository whose .vscode/tasks.json runs a harmless echo CANARY-TEST on folder open. Nothing runs until you trust the folder.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/untrusted-repositories">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.