Execution safety, control 3 of 9
S-03 Treat retrieved instructions as untrusted content
P0Hard gateNeeds your evidence
External material is evidence to analyse, not authority to change the agent's goals, permissions or tools. Filtering malicious phrases is not sufficient protection.
- Priority
- Gate. A FAIL stops publish or launch.
- Hard gate
- Yes. A FAIL stops publication, whatever the score.
- Change class
- READ_ONLY: Inspect authorised evidence.
- Quality bucket
- Not scored: hard gate only
Evidence to review
- Adversarial fixture tests, tool-call review and an instruction/data separation design.
How to implement
- Separate data extraction from tool-execution decisions.
- Do not run commands, install packages or reveal secrets because a page requests it.
- Validate structured outputs and restrict tool arguments.
- Record suspicious content and continue safe unrelated work.
How UltimateSEO checks this
Needs your evidence. No automated check covers this control, so it stays UNKNOWN until evidence is supplied.
States used: PASS, FAIL, UNKNOWN, NOT_APPLICABLE or BLOCKED. UNKNOWN is never shown as a pass. How states work.
Part of The UltimateSEO Framework v4.3, catalogue dated 2026-10-14. Evidence states, control states and the publish gate are explained on the hub.