Imagine reviewing a pull request that adds six lines of JSON. No application code changes. The description says, “Connect the assistant to our reporting tool.”
Those six lines choose a package, start a process, set its working directory, and pass it a credential. What should the reviewer approve?
The security impact lives in the actions selected by the configuration.
Read the field, then follow the consequence
| A field that looks like data | What it may control | Review question |
|---|---|---|
| Package or module | Code loaded into a trusted process | Which exact artifact will run? |
| Command and arguments | Process creation | Can a value become a flag or shell expression? |
| Working directory | Relative imports and file access | Who can modify that directory? |
| MCP endpoint | Tool metadata and outbound traffic | Which identity and data reach this destination? |
| Approval mode | Unattended side effects | Which actions stop requiring a person? |
This is more than a hypothetical concern. In the Claude Agent SDK advisory, an untrusted resume value could become a command-line flag and introduce an MCP configuration.
The CrewAI issue involved configuration influencing module import. Two Flowise advisories traced execution through package selection and working-directory behavior.
The shared lesson is about the transition from a value to an action. A schema can confirm that a field is a string while the string still selects dangerous behavior.
What a useful review comment sounds like
“This package reference floats. Please resolve the version and source digest so we can approve what will actually execute.”
“This identifier reaches a CLI parser. Reject unexpected flag syntax and use the SDK's structured interface where available.”
“This server only needs reports. Give it a dedicated read credential and a narrow filesystem view.”
Each comment names a consequence and a control. Asking whether the JSON is valid would miss all three.
Follow the change into runtime
A reviewed file is only the starting point. The resolved dependencies, downloaded tool definitions, environment variables, and local overrides may change what the agent receives.
Record the configuration hash alongside the artifact digests and effective capabilities. When those values drift, the earlier approval needs to be reconsidered.
For teams turning this into a repeatable process, auditing configuration as code covers the review and deployment workflow. Start with the fields that can launch code, select credentials, or widen access. They deserve the clearest diff.