Installing MCP servers and skills for fun? Understand prompt injection first
TL;DR
Prompt injection happens when content an agent reads (web pages, files, tool results) contains instructions meant to steer it. Risk spikes when an agent can read untrusted content, access private data, and send data out — all at once. Removing any one of the three is the most effective defense.
The dangerous trio
| Factor | Examples |
|---|---|
| Reads untrusted content | Web, email, strangers' issues/PRs, downloaded docs |
| Accesses private data | Internal code, .env, databases, inboxes |
| Has an outbound channel | HTTP requests, email, public issues, git push |
Defensive rules
- Only install MCP servers/skills you've read: SKILL.md, bundled scripts, declared tools.
- Least privilege: read-only GitHub tokens when you only read; enable MCP read-only modes.
- Keep permission prompts: avoid
--dangerously-skip-permissionsoutside a sandbox. - Deny rules + hooks: block reading secrets and network calls to unknown domains.
- Separate sessions: web-research sessions don't hold production credentials.
- Review before sending: agent-drafted emails, PRs and comments get human eyes.
References: Claude Code security · MCP security best practices