Review tool descriptions for hidden instructions

Pin tool versions and review updates before upgrading

Apply principle of least privilege per tool

Requires API keys or tokens to function. If the tool is compromised, your API keys could be exfiltrated and used for unauthorized access or billing abuse.

• ●Access your API quotas and billing
• ●Impersonate your identity to services
• ●Leak keys to third parties

Can read and write files on your system. Malicious tools can steal SSH keys, credentials, browser data, or modify configuration files.

• ●Read ~/.ssh/*, ~/.aws/credentials
• ●Access browser cookies and passwords
• ●Modify config files or inject code