Review tool descriptions for hidden instructions

Pin tool versions and review updates before upgrading

Apply principle of least privilege per tool

Requires API keys or tokens to function. If the tool is compromised, your API keys could be exfiltrated and used for unauthorized access or billing abuse.

• ●Access your API quotas and billing
• ●Impersonate your identity to services
• ●Leak keys to third parties

Can make outbound network requests. A compromised tool can exfiltrate stolen data, download additional payloads, or communicate with command-and-control servers.

• ●Send data to external servers
• ●Download malicious payloads
• ●Establish reverse shells