Safety and permissions Required

Review agent settings like code

Treat instruction files, agent settings, hooks and rule folders as code that can run. Review every change to them and scan them for hidden text.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

A poisoned instructions file can steer an agent without showing anything to a person. Attackers hide orders in invisible Unicode characters. Project settings can also start hooks and tool servers when a session opens. List these files in the code owners file, including skills, commands and MCP server settings such as .mcp.json. Open repositories you do not trust only in a sandbox, and read their agent files first.

Example

LC_ALL=C.UTF-8 grep -rlP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{FEFF}\x{E0000}-\x{E007F}]' \
  AGENTS.md CLAUDE.md .claude .cursor .github/copilot-instructions.md .github/instructions .mcp.json 2>/dev/null && exit 1 || exit 0

How to check

A script fails the build when an instruction or settings file holds invisible or direction-changing characters. The code owners file covers every agent file.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/review-agent-config.