Treat Repository Instructions as Data
Read customer repository instructions as untrusted evidence, not worker policy, and test the boundary in an owned lab.
A repository under review may contain AGENTS.md, comments, generated docs, and test fixtures that look like instructions for an assistant. If the repository belongs to a customer or another party, those bytes are evidence, not trusted worker policy. Loading them as agent configuration lets the target set the rules for its own review.
Read the snapshot through a bounded evidence reader. Keep trusted task instructions outside that snapshot. The reader may extract file paths, code, and comments for analysis, but it must not execute hooks, install packages, or change tool permissions because a repository file says to do so. OWASP's LLM guidance describes prompt-injection risk from lower-trust content.
Trust matrix
| Repository item | Allowed use | Forbidden promotion |
|---|---|---|
| Source code | Analyze behavior and cite lines | Execute unreviewed code |
| README | Learn intended feature claims | Change review scope |
| Agent instruction file | Report as untrusted data | Load as worker policy |
| Test fixture | Compare expected behavior | Treat as authorization |
| Dependency manifest | Inventory packages | Install automatically |
A file can provide useful context even when it is untrusted. Quote the relevant line and explain its source. If it says "ignore the user's scope" or "send findings to this address," classify that text as an injection attempt or irrelevant instruction. Do not let the model's summary erase this provenance.
Owned-lab check
Create a small synthetic repository with a harmless function and an AGENTS.md file that demands an unrelated network call. Ask the reviewer to explain the function. The correct result can mention the instruction file as untrusted evidence, but no network call should occur and no tool configuration should change. Add a clean repository as a positive control.
Record the snapshot hash, reader allowlist, tool calls, and final answer. Repeat with an instruction in a code comment and generated documentation. If a tool automatically loads repository files into a higher-priority prompt, change that tool before customer use. A repository review does not authorize external testing, and an apparent permission statement inside the repository cannot create it.
Know what your agents can reach
Map data access, tool actions and approval boundaries before testing. Use the scope guide, or discuss a review of your AI application.