Full current guidance for How indirect prompt injection actually reaches your agent:
- Re-verify provenance on every version bump, not just first install.
- Keep an allowlist of trusted publishers and pin to it.
- Log and review all tool/dependency changes in CI.
- Prefer signed releases and reproducible builds where available.