Overview
Agent conversations may be stored locally. Secrets pasted into chat can therefore persist in plain text outside the intended credential store. The safer pattern is to place API keys and similar values in an environment file and refer to the variable rather than copying the value into prompts.
The environment file should not be committed to version control, read aloud, or reproduced in logs.
Dependency hallucination and package-name abuse
A model may invent or misspell a package name. An attacker can publish a malicious package under a plausible misspelling. Blindly installing every suggested dependency therefore creates a supply-chain path into the system. Before installation, the agent should verify that the package is legitimate, established, and actually required. Existing dependency lists should also be audited for unfamiliar packages.