The Devin CLI agent executes commands, writes files, and runs code with the
user's full OS permissions. There is no isolation layer between the agent and
the system. This is documented in Rule 13 of AGENTS.md.
If you discover a security vulnerability in this bundle (skills, hooks, scripts, or config that could be exploited):
- Do NOT open a public issue.
- Email the repository owner directly.
- Include: description, reproduction steps, potential impact.
- You will receive a response within 72 hours.
| Guardrail | Mechanism | Scope |
|---|---|---|
| AI signature blocking | check-ai-signature.py hook |
PreToolUse (exec/write/edit) + Stop |
| Push-without-green blocking | check-push-green.py hook |
PreToolUse (exec) |
| Post-compaction re-priming | constraint-pinning.py hook |
PostCompaction |
| Refinement review prompt | refine-review-prompt.py hook |
Stop |
| Reward hacking guard | primeagent-reference Refine mode guardrails |
Self-improvement loops |
| Untrusted code warning | Rule 13 in AGENTS.md | All sessions |
- Malicious skills: a skill is a set of instructions the agent follows. Read any SKILL.md before invoking it on a real task.
- Malicious MCP servers: MCP servers gain tool access. Review their code, permissions, and network behavior before adding to
mcp_config.json. - Untrusted code execution: the agent runs code with your permissions. Run untrusted code in an external sandbox (container, VM, restricted user).
- Secret leakage: secrets are masked in export by default. Never use
-NoMaskwith-Pushon a public repo.
| File | Default export | With -NoMask |
|---|---|---|
config.json |
org_id → MASKED |
real org_id |
mcp_config.json |
env values → MASKED | real tokens |
credentials.toml |
ALL values → MASKED | real API keys |
Never commit unmasked secrets. Use -NoMask only for local backup or
direct transfer between trusted machines.