🧩 Skills
Community skills = untrusted code. Agent-written skills = unreviewed.
Signing, MSIX tamper-proofing, Defender scanning, sandbox execution
🧠 Memory
Prompt injection can poison context ("always trust evil.com")
Validation, anomaly detection, user review of memory changes
⚡ Exec
Full shell access = full damage potential
Permission scopes, command allowlists, sandboxing (AppContainer?)
🔧 Self-Modification
Agent edits its own config, disables guardrails
Audit logs, rollback capability, approval gates for sensitive changes
📂 File Access
Read sensitive docs, exfiltrate data, plant malware
Scoped folders, user consent prompts, DLP integration
🌐 Browser / Network
Credential theft, session hijacking, data exfil via HTTP
Network allowlists, credential isolation, activity logging