Installing things on someone else’s computer

A blog post warns that developers should treat installing anything on someone else's computer as a deliberate decision, citing git pre-commit hooks, `npx`/`uvx` commands, and LLM context files such as `AGENTS.md`, `CLAUDE.md`, skills, and MCP. The post notes `AGENTS.md` is now stewarded by the Agentic AI Foundation under the Linux Foundation and claims use by over 60,000 open-source projects, and that `husky init` adds a `prepare` script to `package.json` that npm runs on a plain `npm install`, installing hooks without an explicit decision. The author adds that agents given the ability to install things become the decision-makers, and that local LLM weights can consume storage.

You should be very careful when you make a decision that implies installing something on someone else’s computer. A git pre-commit hook is one such decision.<sup 1</sup So is telling somebody to run uvx or npx .<sup 2</sup And, as an extension of the same thing, so is “installing” context into someone else’s LLM: AGENTS.md , CLAUDE.md , skills, MCP, and the rest.<sup 3</sup The corollary is that on the receiving end, you should be wary of these same commands. And of memory in LLMs.<sup 4</sup So when are you making these decisions? These somewhat extend to data too. Some installers will litter a lot of things in a lot of places, making it difficult to clean up. Have you tried out some local LLM models? Great, now those weights can accidentally eat the rest of your storage. Note that this is easier said than done: a computer installing nothing is safest. It is a conscious choice and a balance. Be mindful of these. Computer will thank you, wallet will thank you, the future-self-from-the-future-that-didn’t-happen will thank you. And if you give your agents the capability to install things<sup 5</sup , now those are the “beings” making those decisions. P.S. I hope we don’t need to explain why installing things can be dangerous, right? This is the least clear-cut of the three, so it is worth spelling out. Git hooks live in $GIT DIR/hooks Git, n.d. , which is not tracked and does not come along with a clone, so committing a .pre-commit-config.yaml does not by itself install anything: each developer still has to get pre-commit onto their machine and run pre-commit install , which writes .git/hooks/pre-commit . The project’s own quick start says that after cloning, running it “should always be the first thing you do” pre-commit, n.d. . So what you commit is a request rather than an installation — but it is a request that usually arrives phrased as a requirement, and it is still your decision showing up on their machine. The JavaScript side shows how thin the line is: husky init adds a prepare script to package.json Husky, n.d. , and npm runs prepare on a plain npm install npm, n.d.-b , so an ordinary dependency install sets the hooks up without anyone deciding to. git config core.hooksPath can also point at a tracked directory, but somebody has to set that config locally too.↩︎ Neither leaves a tool on your PATH , which is what “without installing” means here, and neither is free. npx installs a package that isn’t already present “to a folder in the npm cache”, and prompts first unless you passed --yes npm, n.d.-a . uvx builds the environment in uv’s cache and treats it as disposable — uv cache clean deletes it Astral, n.d. . Code you did not choose is still downloaded and run.↩︎ AGENTS.md is now a format with a steward — the Agentic AI Foundation, under the Linux Foundation — and the site claims use by over 60k open-source projects AGENTS.md, n.d. . That is a lot of repositories in which a file written by one person configures everybody else’s agent.↩︎ I mentioned this because this can happen automatically, accidentally “installing” a thing you’ve said and changed your mind about, and that “malware” persists to come back and bite you again.↩︎ Even just ability to edit files can be an ability to install, e.g. pixi.toml .↩︎