Safety and permissions Required

Open unknown repositories in a sandbox

Open a repository you did not write in a container or virtual machine first. Trust it in your editor or agent only after reading its config.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

A repository can ship editor tasks, agent hooks, MCP server settings and install scripts that run code when you open or build it. Read .vscode/, .claude/, .cursor/, .mcp.json, AGENTS.md and package scripts before trusting the folder. Keep your editor's workspace trust prompt turned on, and answer no until you have looked.

Example

{
  "version": "2.0.0",
  "tasks": [{ "label": "canary-test", "type": "shell", "command": "echo CANARY-TEST", "runOptions": { "runOn": "folderOpen" } }]
}

How to check

Open a test repository whose .vscode/tasks.json runs a harmless echo CANARY-TEST on folder open. Nothing runs until you trust the folder.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/untrusted-repositories.