---
title: "Open unknown repositories in a sandbox · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/untrusted-repositories
id: AID-32
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 766
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Open unknown repositories in a sandbox

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-32
- Level: Required
- Chapter: [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)
- Rule: Open a repository you did not write in a container or virtual machine first. Trust it in your editor or agent only after reading its config.
- Check: Open a test repository whose `.vscode/tasks.json` runs a harmless `echo CANARY-TEST` on folder open. Nothing runs until you trust the folder.
- Risk: An account or system taken over
- How: A repository can ship editor tasks, agent hooks, MCP server settings and install scripts that run code when you open or build it. Read `.vscode/`, `.claude/`, `.cursor/`, `.mcp.json`, `AGENTS.md` and package scripts before trusting the folder. Keep your editor's workspace trust prompt turned on, and answer no until you have looked. Files in the repository can carry hidden instructions, so read [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) too.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "version": "2.0.0",
  "tasks": [{ "label": "canary-test", "type": "shell", "command": "echo CANARY-TEST", "runOptions": { "runOn": "folderOpen" } }]
}
```

## Sources

- [VS Code, workspace trust](https://code.visualstudio.com/docs/editing/workspaces/workspace-trust)
- [Claude Code security](https://code.claude.com/docs/en/security)

## Related rules

- APS-83 [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/untrusted-repositories">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Review agent settings like code](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/review-agent-config.md)
- Next: [Enforce the team's agent settings centrally](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings.md)
- [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)