A prompt-injection checklist for AI coding agents.

The checklist

1. Enforce outside the model. Approvals and limits belong in the client that executes actions, not only in the model’s instructions. In Topsoil: approvals, allowlists and path checks are enforced in the client.
2. Plan before acting. Require an approved plan before anything is written. In Topsoil: plan mode is read-only until you approve.
3. Show exact actions. Every edit as a diff, every command as its exact program and arguments. In Topsoil: the default mode asks before each file change, command or network use.
4. Allowlist commands and run them without a shell. In Topsoil: commands run only if they start with an allow-listed prefix.
5. Keep egress off by default. In Topsoil: outbound network access for a command is off unless the tool asks and you approve it.
6. Check paths before tools touch them, and use a filesystem sandbox where you can. In Topsoil: tools carry a risk class, paths are checked, and an optional sandbox is available.
7. Scope tools per project. Only connect the MCP servers a project needs, and keep credentials out of the workspace. In Topsoil: MCP tools are enabled per project, with secrets kept host-side.
8. Isolate the work. In Topsoil: handed-over tasks run in their own git worktree on their own branch.
9. Never let the agent merge. A person reviews and merges. In Topsoil: changes come back as pull requests, and unattended runs open drafts.
10. Bound spend. A looping, manipulated agent should hit a ceiling. In Topsoil: run, loop and monthly budgets, with an AWS budget action backstop.

No list removes the risk entirely. The OWASP Top 10 for LLM applications ranks prompt injection first, and NVIDIA’s AI red team advises treating model output that drives tools as untrusted.