The Convenience Layer Must Not Outrun the Isolation Layer

Everything Claude Code (ECC) treats agent configuration as part of the security boundary. The specific question is how text or configuration moves from a repository, attachment, skill, hook, MCP server, or memory file into an action taken by a model with tools. Understanding that path lets a reader choose controls that reduce blast radius instead of trusting GateGuard, AgentShield, or a prompt warning to solve a problem they were not designed to solve.

The central security idea is least agency: give an agent only the identities, files, network routes, tools, and approval authority that the task needs. The model may follow instructions faithfully and still be dangerous if the instructions came from hostile content or if the runtime gives the model more reach than the work requires. ECC's guidance therefore treats prevention, detection, human approval, isolation, logging, and stopping as different layers.

When configuration becomes part of the attack surface

A source file is not the only thing an agent can act on. Project instructions enter the context. A hook can execute a command around a tool call. An MCP configuration can introduce a server with credentials and tool descriptions. A skill can contain a directive that changes how the model reasons. A linked document or attachment can carry text that looks like data to a person but appears as instruction to the model. Persistent memory can return a fragment from an earlier run when the original source is no longer visible.

The risk is a chain, not one malicious sentence. Untrusted content enters the model's context; the model selects or proposes a tool; the host supplies permissions; a hook or connector changes the execution path; the tool reaches a file, process, network destination, or external account. If private data, untrusted content, and external communication share the same runtime, a prompt-injection problem can become a data-exposure or workflow-abuse problem. The model is one mediator in that chain, not the entire boundary.

Imagine an agent asked to summarize a foreign repository and prepare a local patch. A README or issue comment contains a directive to read a credential-bearing file and send its contents to a remote endpoint. If the agent has no access to that path, no route to the endpoint, and no permission to run an unsandboxed command, the hostile text may still distort the summary but cannot easily become exfiltration. If the same agent has broad home-directory reads, a credentialed connector, and automatic network approval, the exact same text can cross several boundaries before a human notices. The content did not become more persuasive; the runtime became more capable of turning persuasion into effect.

ECC's security guide therefore says to treat hooks, MCP servers, and context controls as executable configuration. The official-source warning follows the same logic: installing a re-uploaded plugin or skill is not like reading an ordinary article. It adds behavior to a runtime that may be trusted with local files or credentials.