alt Hacker NewsIn this case you could give it its own SSH key, and only allow that key to access what you want. I actually do that, it doesn't share my own SSH key. It also has its own Github account instead of getting access to mine.
For access to services, most allow tokens to be scoped to only allow the things you want.
Those sound good, but say in this case you had the compromised extension which had its own ssh key to an IP that wasn't yours. I'm not sure how you easily prevent that connection without preventing the ones you need through sandboxing. Maybe a firewall/very specific network filtering in allowlist?