Setup instructions are an agent attack surface

The arXiv paper 'Setup Complete, Now You Are Compromised' studies attacks that hide malicious instructions in repository setup material such as READMEs, dependency files, or build commands used by AI coding agents. Why it matters: Coding agents often execute the first instructions they find in a repository. That makes setup paths a governance boundary: bootstrap commands, dependencies, and repo-local guidance need review before an agent receives broad tool access.

Try this: Before running an unfamiliar repo through a coding agent, inspect setup files, dependency scripts, and repo instructions; then run bootstrapping in a sandbox with limited secrets and a clear command allowlist.