Trying to set up a prompt injection attack for someone accessing a repo with a coding agent is juvenile and pointless. And it doesn't deal with the training part.