A tool is an authority boundary
Connecting an agent to tickets, source control, or a database changes what a prompt can affect. Review the exact read and write scopes instead of approving a product name in the abstract.
Outputs can carry instructions
Search results, issues, documents, and web pages may contain text that tries to redirect the agent. A safe workflow treats connected content as data, keeps system and repository rules authoritative, and validates any proposed action.
Plan for removal
Know how to rotate the credential, revoke the connection, inspect recent actions, and continue without the tool. A plugin is ready for team use when its failure and offboarding paths are as clear as its happy path.