Principle
Treat issue and PR text as untrusted agent input
A familiar repository surface can still carry instructions for the model.
When it fits
- You ask an agent to fix an issue or address review comments written by people outside your trust boundary.
When to avoid it
- Prompt-injection filtering is imperfect; combine context limits with permission boundaries and review.
Why it matters
Separate the developer's task authority from content the agent reads. Treat issue bodies, comments, READMEs, logs and fetched pages as data unless explicitly promoted by a trusted human. After processing external content, inspect for unrelated file, network or tool actions.
An example
A public issue contains a hidden instruction to modify a workflow; the agent may read the issue, but the workflow change is rejected as outside task authority.
Check your result
Repository location alone does not make a piece of text authoritative to the agent.
Keep this limit in mind
- Prompt-injection filtering is imperfect; combine context limits with permission boundaries and review.
Connected ideas
Useful withTreat retrieved content as data, not as new authority
Evidence and sources
OWASP's current secure-coding-with-AI guidance treats repository content, issues, PRs, comments, fetched pages, logs and tool responses as potential indirect prompt-injection inputs for coding agents.
Threat likelihood depends on who can influence the content and what permissions the agent has.
Secure Coding with AI Cheat Sheet · Indirect Prompt Injection in the Development Loop