AgentShell separates application account state; it does not isolate operating-system permissions.
- Every profile can access every file the current Unix user can access.
- Do not treat profiles as protection from untrusted prompts, repositories, plugins, MCP servers, or agents.
- Never commit
~/.local/share/agentshell, profileenv.shfiles, authentication files, or session data. - Prefer browser/device login. If an API token is necessary, store it only in the relevant profile's mode-0600
env.sh. - Review shared skills and plugins before using them with company or lab accounts; shared customization is visible to all named profiles.
Report security issues privately to the repository owner rather than opening a public issue with credentials or private logs.