When documentation becomes executable output

An example is not necessarily passive

A coding agent may adapt a configuration or code example into working output. The boundary matters even when the prose does not contain an obvious instruction to ignore the user. Research on supply-chain poisoning studies this documentation-to-action path.

Follow the copied material

Identify which examples the task consumed and where their content appeared in generated files, configuration, or commands. Review the output under its actual permissions. A harmless-looking sample can become consequential when inserted into a privileged deployment file.

Keep three artifacts: the exact example, the generated change, and the action that used the change. The relationship between them is more informative than a keyword found in isolation.

Separate examples from approved execution

Use previewable changes, constrained test workspaces, and independent approval for sensitive effects. Review external destinations and dependencies as part of the generated artifact. An expected output file is not proof that the rest of the workflow stayed within scope.

Choose evidence over blanket conclusions

The linked experiment uses an adversarial corpus. It establishes an evaluated mechanism, not the current proportion of malicious documentation online. For a real package, distinguish a concerning example from attempted execution and verified impact.

Worked example: a configuration sample changes a deployment

A coding skill provides a configuration template. The template contains an additional package source that is unrelated to the requested application. The agent copies it into a generated file, but no deployment takes place. At this point the evidence is a generated unauthorized configuration, not a completed installation or compromised production system.

Work through the evidence

Trace the original template, resulting diff, review step, and any command that consumes the configuration. Ask whether each changed value serves the user’s actual task. Distinguish text generation from execution, and execution from a verified downstream effect. Test with a disposable project rather than deploying an unreviewed artifact.

Decision criteria and a useful review record

Hold a generated artifact that adds unexplained recipients, package sources, credentials, or hooks. A successful build is not enough to justify those additions. Require an independent decision before a generated configuration acquires privileged effect. Preserve the final applied state as well as the agent’s proposed patch, because those can differ.