SymptomA run labelled as a test navigates real websites, changes real files and calls real connected tools.
CauseThe product has no rehearsal or sandbox mode. Approvals gate only the proposed action and do not reverse work already completed, so safety is entirely preventive.
DetectionStated plainly in the official documentation and repeated by five independent third-party sources; not something a user discovers, something they must be told.
FixTest only on safe inputs. Gate every external write behind approval from the first run, using Allow once during testing and Always Allow only after a workflow is stable. Require approval for sending, purchasing, deleting, publishing and changing production systems. One source proposes building an application-level dry-run output contract into the skill itself, since the product provides none.