Agent safety checklist
Set up coding and automation agents with least privilege, sandboxing, secret hygiene, prompt-injection defences and human checkpoints.
Fill in your details
Values are inserted into every prompt below. Nothing you type leaves your browser.
3 field(s) left — unfilled variables stay as {{placeholders}}.
1Permissions and environment
☐ Run agents in a sandbox, container, VM or dedicated dev environment, not on a machine with production access. ☐ Least privilege: allow-list the commands and tools the task needs; require confirmation for anything else. ☐ No production credentials in the agent's environment; use scoped, short-lived tokens for staging. ☐ Network access restricted to what the task needs (package registry, your git host). ☐ Agent works on a branch; it can't push to main or deploy.
2Secrets and data
☐ .env and credential files excluded from what the agent can read, or replaced with dummy values. ☐ Secret scanning runs on every commit and PR. ☐ No customer personal data in prompts, fixtures or logs. ☐ You know your provider's data retention and training settings for your plan.
3Untrusted input and prompt injection
☐ Treat web pages, issues, emails, documents and tool outputs the agent reads as untrusted: they can contain instructions. ☐ Agents that read untrusted content shouldn't also hold powerful permissions (sending email, spending money, deleting data) without human confirmation. ☐ Third-party MCP servers, plugins and skills are reviewed before installation, pinned to versions and given minimal scopes. ☐ Be cautious with tools that can send data out (HTTP requests, email), since they can be used to exfiltrate what the agent has read.
4Human checkpoints and recovery
☐ Destructive actions (delete, force-push, migrations, payments, outbound messages) need explicit approval. ☐ All changes go through normal code review and CI. ☐ Agent actions are logged. ☐ You can roll back: version control, backups, feature flags. ☐ A budget or usage limit is set to cap runaway loops.
5Audit an agent setup
Paste your agent configuration (permission settings, tool list, MCP config) with secrets removed.
Audit this AI agent setup for security risks. Agent configuration (permissions, allowed commands, settings): {{agent_config}} Tools, MCP servers, plugins or skills it can use: {{tools_list}} Sensitivity of the data and systems it can reach: {{data_sensitivity}} Assess: (1) permissions broader than needed, (2) dangerous combinations — especially reading untrusted content while being able to send data out or take irreversible actions, (3) secret exposure, (4) missing human checkpoints, (5) third-party components that need review. For each finding give severity (Critical/High/Medium/Low), the specific setting, the attack or failure scenario in one or two sentences, and the concrete change to make. End with the three changes that reduce risk most.
Example input
Agent with unrestricted shell, GitHub MCP with full repo scope, web fetch and Slack posting.
Example output
Critical — web fetch + Slack posting + repository read Scenario: a fetched web page contains hidden instructions to post repository secrets or code to a Slack channel. Change: require approval for every Slack post, or remove Slack from this agent. High — shell allows any command Scenario: a mistaken or injected "rm -rf" or "git push --force". Change: allow-list test, lint and git status/diff/commit; require approval for everything else.
Troubleshooting
- Audit is too generic: include actual configuration text rather than a description of it.
Known limitations
- No checklist eliminates prompt-injection risk; reduce what a compromised agent can do.
- Not a substitute for a security review of high-risk deployments.