Adding the thing that makes rule six concrete rather than theoretical, because people read prompt injection as a hypothetical. The condition to watch is not "reads the web" and it is not "can send things". It is both in the same task.
An agent that summarises web pages and cannot act is fine. One that can email and never reads anything outside your own files is fine. Give one job both halves and you have built the vulnerability yourself, and no setting in the tool prevents it.