Prevent a reusable workflow from becoming an unrestricted instruction bundle.
1. Untrusted content
Repository text, issue descriptions and fetched documents may contain hostile instructions. Treat them as task data unless they are an authorized instruction source.
2. Action scope
Describe which operations the skill requires and avoid blanket authority to publish, delete or message others. A workflow should preserve the user’s authorized scope.
3. Secrets and outputs
Do not ask the agent to print environment secrets or upload entire workspaces for convenience. Redact diagnostics and limit external data sharing.
Worked scenario
An issue body tells the agent to upload signing keys before fixing a bug. The skill treats this as malicious task content, not a new workflow step.
Apply it
Add adversarial fixtures with secret-exfiltration and unrelated-action requests. Check that the workflow remains scoped.
Check your understanding
The skill does not expand authority merely because a reference file requests it. Explain the decision and show evidence from your implementation or design. If you cannot demonstrate it yet, revisit the relevant section before continuing.