It can also contain instructions, scripts, configuration, and agent-specific files that influence what your AI assistant does.
repository files Git history project instructions configuration scripts agent skills MCP tools documentation
A skill can contain a SKILL.md file, additional instructions, and even scripts that an agent can use.
GitHub explicitly warns that skills from repositories are not verified and may contain prompt injections, hidden instructions, or malicious scripts.
A file that looks like documentation to you may be an instruction source for your agent.
Researchers documented a class of attacks involving Git's core.fsmonitor setting.
The problem discovered by researchers was that a malicious Git configuration could cause attacker-controlled code to execute when the coding agent triggered those normal Git operations.
According to the Cloud Security Alliance's write-up, researchers documented findings affecting several popular coding agents, including:
That does not mean every repository can automatically compromise every version of these tools.
Vendors can patch vulnerabilities, and protections differ between products and versions.
Opening an untrusted repository with an autonomous coding agent can have a larger attack surface than simply reading the files yourself.
how the project is structured how tests should run which coding conventions to follow how deployments work which tools it can use
The good news is that the basic precautions are not complicated. Inspect Before Trusting
Before opening an unknown repository with a highly privileged coding agent, inspect it first.
.git/config agent instruction directories MCP configuration shell scripts package scripts unfamiliar automation repository-specific AI skills
production credentials cloud accounts SSH keys personal tokens customer databases
Give the minimum permissions required to complete the task. Use a Sandbox for Unknown Projects
If something unexpected runs, the potential damage is smaller. Review Agent Skills Before Installing Them