{"slug": "installing-things-on-someone-elses-computer", "title": "Installing things on someone else’s computer", "summary": "A blog post warns that developers should treat installing anything on someone else's computer as a deliberate decision, citing git pre-commit hooks, `npx`/`uvx` commands, and LLM context files such as `AGENTS.md`, `CLAUDE.md`, skills, and MCP. The post notes `AGENTS.md` is now stewarded by the Agentic AI Foundation under the Linux Foundation and claims use by over 60,000 open-source projects, and that `husky init` adds a `prepare` script to `package.json` that npm runs on a plain `npm install`, installing hooks without an explicit decision. The author adds that agents given the ability to install things become the decision-makers, and that local LLM weights can consume storage.", "body_md": "You should be very careful when you make a decision that implies installing something on someone else’s computer. A git pre-commit hook is one such decision.<sup>1</sup> So is telling somebody to run `uvx` or `npx`.<sup>2</sup> And, as an extension of the same thing, so is “installing” context into someone else’s LLM: `AGENTS.md`, `CLAUDE.md`, skills, MCP, and the rest.<sup>3</sup>\n\nThe corollary is that on the receiving end, you should be wary of these same commands. And of memory in LLMs.<sup>4</sup>\n\nSo when are you making these decisions?\n\nThese somewhat extend to data too. Some installers will litter a lot of things in a lot of places, making it difficult to clean up. Have you tried out some local LLM models? Great, now those weights can accidentally eat the rest of your storage.\n\nNote that this is easier said than done: a computer installing nothing is safest. It is a conscious choice and a balance.\n\nBe mindful of these. Computer will thank you, wallet will thank you, the future-self-from-the-future-that-didn’t-happen will thank you.\n\nAnd if you give your agents the capability to install things<sup>5</sup>, now those are the “beings” making those decisions.\n\nP.S. I hope we don’t need to explain why installing things can be dangerous, right?\n\nThis is the least clear-cut of the three, so it is worth spelling out. Git hooks live in `$GIT_DIR/hooks` (Git, n.d.), which is not tracked and does not come along with a clone, so committing a `.pre-commit-config.yaml` does not by itself install anything: each developer still has to get `pre-commit` onto their machine and run `pre-commit install`, which writes `.git/hooks/pre-commit`. The project’s own quick start says that after cloning, running it “should always be the first thing you do” (pre-commit, n.d.). So what you commit is a request rather than an installation — but it is a request that usually arrives phrased as a requirement, and it is still your decision showing up on their machine. The JavaScript side shows how thin the line is: `husky init` adds a `prepare` script to `package.json` (Husky, n.d.), and npm runs `prepare` on a plain `npm install` (npm, n.d.-b), so an ordinary dependency install sets the hooks up without anyone deciding to. `git config core.hooksPath` can also point at a tracked directory, but somebody has to set that config locally too.↩︎\n\nNeither leaves a tool on your `PATH`, which is what “without installing” means here, and neither is free. `npx` installs a package that isn’t already present “to a folder in the npm cache”, and prompts first unless you passed `--yes` (npm, n.d.-a). `uvx` builds the environment in uv’s cache and treats it as disposable — `uv cache clean` deletes it (Astral, n.d.). Code you did not choose is still downloaded and run.↩︎\n\n`AGENTS.md` is now a format with a steward — the Agentic AI Foundation, under the Linux Foundation — and the site claims use by over 60k open-source projects (AGENTS.md, n.d.). That is a lot of repositories in which a file written by one person configures everybody else’s agent.↩︎\n\nI mentioned this because this can happen automatically, accidentally “installing” a thing you’ve said and changed your mind about, and that “malware” persists to come back and bite you again.↩︎\n\nEven just ability to edit files can be an ability to install, e.g. `pixi.toml`.↩︎", "url": "https://wpnews.pro/news/installing-things-on-someone-elses-computer", "canonical_source": "https://blog.kolen.dev/misc/installing.html", "published_at": "2026-09-18 00:00:00+00:00", "updated_at": "2026-09-18 18:56:19.064848+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "developer-tools"], "entities": ["Agentic AI Foundation", "Linux Foundation", "MCP", "pre-commit", "Husky", "npm"], "alternates": {"html": "https://wpnews.pro/news/installing-things-on-someone-elses-computer", "markdown": "https://wpnews.pro/news/installing-things-on-someone-elses-computer.md", "text": "https://wpnews.pro/news/installing-things-on-someone-elses-computer.txt", "jsonld": "https://wpnews.pro/news/installing-things-on-someone-elses-computer.jsonld"}}