i-have-adhd

Least-privilege permissions

• Run the skill in a sandboxed environment with read-only access to code artifacts; restrict write permissions to output streams only
• If integrated with a coding agent, use role-based access controls to limit which repositories or code sections it can process
• Disable any file system access beyond the specific input/output directories needed for the skill's formatting logic
• Require explicit allowlisting of agent response types before the skill processes them

Network isolation

• Isolate execution from external network access; block all outbound connections unless explicitly needed for updates
• If updates are required, use pinned version URLs or internal mirrors rather than pulling directly from npm/GitHub
• Audit and document all transitive dependencies; consider vendoring critical ones to reduce supply chain exposure
• Disable telemetry or analytics features if present; verify with network monitoring that reformatted outputs aren't exfiltrated

Monitoring

• Log all inputs (agent responses) and outputs; flag unusually large payloads or suspicious formatting patterns
• Alert on any attempted file writes outside designated output directories
• Monitor for repeated prompt injection attempts in agent responses (e.g., embedded instructions, escape sequences)
• Track skill version and dependency versions; alert on unauthorized updates or version mismatches

Red flags to watch for

• Skill processes and returns unescaped code or credentials from agent output without sanitization
• No recent commits or maintenance activity; verify codebase before adopting in production
• Agent responses containing control characters, encoding tricks, or meta-instructions pass through formatting unchanged
• Skill configuration allows dynamic code execution, eval(), or template injection in the output formatting pipeline