Authority attacks
Reject instructions that claim higher priority, ignore user or system rules, suppress approvals, conceal actions, or redefine the task beyond the user's request.
Credential and data access
Question broad searches of home directories, SSH material, browser state, cloud credentials, environment files, logs, or unrelated repositories. Require a task-specific reason and explicit scope.
Remote execution
Inspect every URL, installer, package, script, binary asset, and dynamic download. Never execute a network response directly. Pin reviewed versions or commits and record provenance.
Allowed tools
Read-only tools can still expose sensitive data. Write, shell, browser, messaging, deployment, and computer-control tools add consequential side effects. Request only what the workflow actually needs.
Update drift
Re-review diffs when a skill changes. A previously trusted name can gain new scripts, permissions, activation triggers, or data destinations after installation.