You should be very careful when you make a decision that implies installing something on someone else’s computer. A git pre-commit hook is one such decision.<sup>1</sup> So is telling somebody to run uvx or npx.<sup>2</sup> And, as an extension of the same thing, so is “installing” context into someone else’s LLM: AGENTS.md, CLAUDE.md, skills, MCP, and the rest.<sup>3</sup>
The corollary is that on the receiving end, you should be wary of these same commands. And of memory in LLMs.<sup>4</sup>
So when are you making these decisions?
These somewhat extend to data too. Some installers will litter a lot of things in a lot of places, making it difficult to clean up. Have you tried out some local LLM models? Great, now those weights can accidentally eat the rest of your storage.
Note that this is easier said than done: a computer installing nothing is safest. It is a conscious choice and a balance.
Be mindful of these. Computer will thank you, wallet will thank you, the future-self-from-the-future-that-didn’t-happen will thank you. And if you give your agents the capability to install things<sup>5</sup>, now those are the “beings” making those decisions.
P.S. I hope we don’t need to explain why installing things can be dangerous, right?
This is the least clear-cut of the three, so it is worth spelling out. Git hooks live in $GIT_DIR/hooks (Git, n.d.), which is not tracked and does not come along with a clone, so committing a .pre-commit-config.yaml does not by itself install anything: each developer still has to get pre-commit onto their machine and run pre-commit install, which writes .git/hooks/pre-commit. The project’s own quick start says that after cloning, running it “should always be the first thing you do” (pre-commit, n.d.). So what you commit is a request rather than an installation — but it is a request that usually arrives phrased as a requirement, and it is still your decision showing up on their machine. The JavaScript side shows how thin the line is: husky init adds a prepare script to package.json (Husky, n.d.), and npm runs prepare on a plain npm install (npm, n.d.-b), so an ordinary dependency install sets the hooks up without anyone deciding to. git config core.hooksPath can also point at a tracked directory, but somebody has to set that config locally too.↩︎
Neither leaves a tool on your PATH, which is what “without installing” means here, and neither is free. npx installs a package that isn’t already present “to a folder in the npm cache”, and prompts first unless you passed --yes (npm, n.d.-a). uvx builds the environment in uv’s cache and treats it as disposable — uv cache clean deletes it (Astral, n.d.). Code you did not choose is still downloaded and run.↩︎
AGENTS.md is now a format with a steward — the Agentic AI Foundation, under the Linux Foundation — and the site claims use by over 60k open-source projects (AGENTS.md, n.d.). That is a lot of repositories in which a file written by one person configures everybody else’s agent.↩︎
I mentioned this because this can happen automatically, accidentally “installing” a thing you’ve said and changed your mind about, and that “malware” persists to come back and bite you again.↩︎
Even just ability to edit files can be an ability to install, e.g. pixi.toml.↩︎