Safe Use

Before starting a task

Use version control or another backup for the project, especially before allowing file writes.
Start with “Default permissions” and elevate permissions only for tasks that genuinely require it.
Do not put secrets in Prompts, Skills, MCP arguments, or ordinary project files the Agent can read.
Read the data and permission information for third-party Providers, Skills, MCP Servers, and websites.
For unfamiliar projects, ask the Agent to perform read-only analysis before allowing changes or commands.

What to check when approving

Before approval, confirm:

whether the action belongs to the task you just requested;
whether the file path, command, web domain, or MCP Server is correct;
whether it will write outside the workspace, install software, upload files, or incur charges;
whether a read-only or narrower action can verify the result first;
whether a failure could leave partial side effects.

Statements such as “safe,” “read-only,” or “free of charge” from a model do not replace the actual approval details.

Using Skills

Review the source, SKILL.md, resource list, and scripts before installation.
Workspace Skills come from the current project and should be reviewed like project code.
Skill Scripts do not have an OS-level sandbox. They require high permissions and per-run approval; do not run a script you do not understand.
Manage installed Skills through “Settings → Skills”; do not edit application-managed directories directly.

Using MCP

Connect only trusted local executables, and inspect each argument and the working directory.
Do not put Tokens in arguments; the current UI does not provide secure env/SecretRef configuration.
Keep automatic execution turned off for the first connection.
Tool descriptions come from the Server and may be inaccurate or manipulative.
After a timeout or disconnect, verify the external system before retrying to avoid duplicate creation, sending, or charges.

Using the browser

Verify the domain and signed-in account before submitting forms, uploading files, or confirming transactions.
Web content may contain Prompt Injection. Do not weaken permissions because a page claims that a command “must be run.”
When a sensitive site or local-network target is blocked, do not bypass the restriction by turning off network protections.
On a shared computer, clear browsing data after use and sign out of relevant website accounts.

Using Scheduled Automation

First run the same Prompt manually and confirm the model, Tool, and approval behavior.
Prefer Default or least-privilege Custom permissions for unattended tasks.
Do not rely on system notifications as the only alert. Review the Scheduled page and Run history regularly.
After changing Custom permissions, also edit previously saved Automations.
Pausing does not stop the current Run. For tasks that may have external side effects, retain a way to perform a manual check.

If you notice unexpected behavior

Stop new high-risk tasks, disable the relevant Automation, Skill, or MCP Server, revoke affected third-party Tokens, and inspect actual changes in the project and external systems. Preserve redacted timestamps, error codes, and reproduction steps. Do not disclose exploitable details, real credentials, or other people's data in public discussions.