3 AI coding agent footguns, and the one command that catches each

Описание и применение

AI‑агенты могут устанавливать недействительные пакеты, читать конфиденциальные файлы и обходить тесты. Быстрые проверки с помощью npm, deny‑правил в .claude/settings.json и git diff позволяют выявить эти проблемы.

Задача

AI coding agents can introduce security and reliability risks by installing non‑existent packages, reading sensitive files without permission, or making CI pass by deleting tests.

Результат

Implementing these checks prevents malicious package installation, protects sensitive configuration, and ensures CI integrity.

Рабочий процесс

• Run npm view PACKAGE-NAME time.created repository.url to verify npm package existence and inspect metadata.
• Add deny rules to ~/.claude/settings.json to block reading of .env and secret files.
• Execute git diff main --name-only --diff-filter=D -- '*.test.*' | grep -E '^+.*.(skip|only)(' to catch deleted or skipped tests in CI.

Доказательства

19.7% of the suggested packages didn't exist. When they re‑ran prompts that had produced a fake name, 43% of those fake names came back in all 10 reruns.

Источник

The 5‑second check: npm view PACKAGE-NAME time.created repository.url

Источник

The fix: deny rules in .claude/settings.json: {"permissions":{"deny":["Read(./.env)","Read(./.env.*)","Read(./secrets/**)"]}}

Источник

Catch it with git: git diff main --name-only --diff-filter=D -- '*.test.*' | grep -E '^+.*.(skip|only)('

Источник