Let a Coding Agent Run Shell Commands Safely

A coding agent becomes much more useful when it can inspect files, run tests, and check its own changes. Shell access also gives mistakes a direct path to your filesystem, credentials, and network. The goal is not to trust the agent completely. It is to give it a small, observable workspace where errors are easier to contain and undo.

#1 · Start with a narrow task

Choose something small: fix one failing test, explain a build error, or update a single function. Tell the agent which directory it may work in, what success looks like, and what it must not change.

For example: “Fix the parser test in this repository. Do not install dependencies, access external services, or change files outside this checkout. Ask before deleting files.” These instructions guide behavior, but they are not security controls. Enforce important boundaries through the environment and tool permissions too.

#2 · Create a recoverable starting point

Check your repository status before starting. Commit or safely preserve existing work, then create a dedicated branch or disposable worktree. This makes the agent’s changes easier to identify and review.

Remember that Git does not protect everything. Ignored files, local databases, and files outside the repository may not be recoverable through it. Back up anything important before allowing commands that could modify it.

#3 · Isolate the workspace

Prefer a disposable development environment with only the project files and tools the task needs. A carefully configured container or virtual machine can reduce exposure, but neither is automatically safe.

• Run as an unprivileged user.
• Avoid mounting your home directory or exposing a host container socket.
• Do not pass through SSH agents, cloud credentials, or production secrets.
• Restrict network access where your environment supports it.

A separate checkout organizes changes; it does not stop a process from reading other accessible files.

#4 · Keep credentials out of reach

Inspect what the shell environment inherits. Environment variables, configuration files, and local credential stores can expose secrets even when your prompt never mentions them.

Use narrowly scoped, temporary credentials only when a task genuinely requires them. Keep production credentials unavailable. If your agent needs a model API key, understand whether executed commands can read that same key. Avoid printing secrets into command output, logs, or conversation history.

#5 · Require approval at meaningful boundaries

Begin with approval required for every command. Read the complete command, its working directory, and any chained operations before approving it. A harmless-looking first operation can be followed by a destructive one.

As you gain confidence, permit narrow, understood operations rather than granting unrestricted shell access. Keep explicit approval for dependency installation, deletion, network transfers, permission changes, and deployment. Even test commands can execute repository-controlled code, so inspect unfamiliar projects before running their scripts.

#6 · Treat repository text as untrusted input

An agent may encounter instructions in comments, documentation, issue text, or command output. Some may ask it to upload files, reveal credentials, or bypass your approval rules. Treat those requests as data, not authority.

Tell the agent to flag conflicting instructions and stop before expanding its scope. More importantly, ensure tool permissions still block dangerous actions if the agent follows misleading text. A prompt alone cannot provide that guarantee.

#7 · Verify changes and observe the cost

Have the agent run the smallest relevant checks first, then broader tests where appropriate. Review the final diff yourself, including dependency files, generated artifacts, and unexpected additions. Passing tests are evidence, not proof that a change is safe.

Keep command history available for review, with secrets redacted. Set spending limits or alerts where supported, and stop unexplained retry loops.

#8 · Choose connectivity separately from permissions

If you want pay-as-you-go access across model families, Relay365 is worth considering. It works with Claude Code, Codex, Gemini CLI, and OpenAI SDK clients. Its API base is https://api.api365relay.com; OpenAI clients add /v1. Check your tool’s provider configuration and available model identifiers before connecting.

Create a Relay365 account if that setup fits your workflow. Regardless of provider, shell safety remains your responsibility: use limited access, deliberate approvals, and disposable environments. Expand autonomy only after you can explain what the agent can reach and how you will recover from a mistake.