Free tools Windows power users keep installed
One-click scans. No signup required.
A checklist for a coding agent only works if each line is an enforced boundary or a human review step, not a request in a prompt. Models can be fooled by text they read, so the checklist below assumes the agent will sometimes follow a malicious instruction and limits what that can cost you. It applies to any agent that can read project material, call tools, run commands and edit code. It draws mainly on OWASP’s Secure Coding with AI and AI Agent Security cheat sheets and its DevSecOps guidance on AI agents and MCP, plus GitHub’s documentation for one product-specific example.
The risk model behind the checklist
OWASP describes the dangerous combination as access to private data, exposure to untrusted content, and the ability to act or communicate externally. Any one of these makes a hijacked instruction worse; together they allow data theft. So the checklist does five things: reduce what the agent can see, reduce what it can do, contain where it runs, limit where it can send data, and require independent authorization when an action executes.
Instructions can also arrive in ordinary-looking material: a README, an issue, a PR comment, a log, a dependency document or a tool description. Appearing inside a developer workflow does not make content trustworthy. OWASP’s DevSecOps guidance puts the principle bluntly: “Do not rely on the model to detect injections; assume it can be fooled and limit the damage through permissions, isolation, and egress control.”
1. Scope the task and constrain permissions
- ☐ I have defined the task and limited the agent to the files, commands and tools it needs.
- ☐ Each tool call is checked against authorization and scope outside the model, and arguments are validated before execution.
OWASP’s rule is “Start from deny and allow explicitly.” Allow only the reads and commands the task requires, block secret locations and unrestricted network or push access, and require approval for everything else. The second item matters because a model’s own judgment that a call is fine is not authorization. The component that executes the call should verify the caller’s permission and the arguments independently, the same way a server validates a request instead of trusting the client.
#1 Best Overall
2. Isolate the run
- ☐ The agent runs in an OS sandbox, disposable dev container or VM, with no production credentials and no unnecessary home-directory mounts.
- ☐ Network egress is disabled or restricted to task-required destinations.
OWASP states: “Permission prompts are not a security boundary against a manipulated agent; isolation is.” An approval dialog can be worn down by habit or phrased misleadingly; a container with no secrets mounted and no route to the internet cannot leak what it never had. Egress limits matter because exfiltration needs somewhere to send data.
Do not assume one sandbox covers every path. OWASP cautions that coverage varies, so check whether it applies to shell commands, file tools and MCP servers, not only one of them.
Rank #2
- Easy to read text
- It can be a gift option
- This product will be an excellent pick for you
3. Keep credentials and sensitive data out of reach
- ☐ Secrets, private keys, credential files and sensitive directories are excluded from the agent’s context and inaccessible to it where possible.
- ☐ The agent uses its own attributable identity with short-lived, least-privilege credentials.
Do not put production or long-lived secrets in prompts, environment variables, shell history, configuration or repository files, all of which an agent may read or echo. A separate agent identity means logs show what the agent did rather than what “you” did, and task-scoped, expiring credentials limit the value of anything leaked. Also check what data leaves the tool, including what is sent to a model provider as context.
4. Treat everything it reads as hostile
- ☐ Issues, pull requests, docs, logs, dependencies, tool descriptions and tool results are handled as untrusted input.
This is a design stance, not a filter. Repository instruction files, web pages, dependency READMEs and issue text from outside contributors can all carry instructions. The practical consequence is that an agent reading untrusted content should not simultaneously hold secrets or unrestricted network and push rights. OWASP’s prompt-injection guidance also recommends testing your boundaries, for example by planting a harmless injected instruction in a test issue and confirming the surrounding controls stop it from doing anything.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
5. Vet tools and MCP servers
- ☐ MCP servers are inventoried, reviewed, version-pinned and re-reviewed when their tools or configuration change.
Approve servers deliberately and keep a list. Inspect the permissions they request and their startup commands, since a local server is code running on your machine. Pin versions, review changes to tool definitions (descriptions are read by the model, so they are an injection channel), and sandbox local servers. Tool outputs need independent validation like any other untrusted input.
6. Gate consequential actions
- ☐ Pushing, merging, deploying, deleting, changing permissions or contacting a new destination requires a human decision on the exact action.
Approval should name the specific command or destination, not grant a blanket “allow for this session.” OWASP’s guidance ties approval to the particular action so that a manipulated agent cannot reuse a broad permission for something else.
7. Verify the diff before it counts
- ☐ I review the complete diff, with special attention to authentication, authorization, cryptography, dependencies, build scripts, CI/CD and deployment configuration.
- ☐ Security analysis, secret scanning and dependency checks run on the resulting changes, and failures are fixed or explicitly dispositioned.
- ☐ Agent actions and resulting diffs are logged without recording secret values, and a human remains accountable for the accepted change.
Changes to CI workflows, package install scripts and deployment files deserve the closest reading, because they run later with broader privileges than the agent had. Keep logs somewhere the agent cannot edit, and name a human owner for the merged code. OWASP’s secure coding guidance is explicit that accountability does not transfer to the tool. Also watch for new or unfamiliar dependencies: a plausible package name the model invented is a supply-chain risk.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A product example: GitHub Copilot cloud agent
GitHub’s documentation on risks and mitigations for the Copilot cloud agent shows several of these controls built into one product: automated validation with CodeQL, secret scanning and dependency analysis; a firewall; prompt-injection mitigations; and draft pull requests that need human review before merge. This is documented behavior for that product, not a universal feature, and not a guarantee that generated code is safe. Check current GitHub documentation for defaults, since they change.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Comparing where you run the agent
When choosing between a local machine, a dev container, a hosted agent or CI, compare them on the same points:
| Question | What to look for |
|---|---|
| Filesystem and network isolation | Does it cover shell, file tools and MCP servers, or only some? |
| Credential exposure and lifetime | Are credentials task-scoped and short-lived, or inherited from your shell? |
| Who enforces permissions | The host or runtime, versus a rule merely written in a prompt |
| Auditability and approval | Independent logs and a human decision on the exact action |
| Fit for local, hosted or CI use | CI runs often have powerful tokens, so they need the tightest scope |
These controls are recommendations derived from OWASP guidance. Products differ in what they implement, and no checklist alone prevents compromise; it makes a successful manipulation smaller and easier to catch.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
