Of 24 videos in my feed, 13 say "comment REPO and I'll send you the l…
A link you got in exchange for a comment is not a link anyone read, and your agent installs it without a second thought. A real audit of two tools from this week, and a six-line sheet to fill in before every install.
You commented "REPO" under a video, and a few hours later five links landed in your DMs. You pasted them into your agent, which installed everything in three minutes. Nobody read anything: not the person who sent the links, not you, and not the agent, which doesn't read, it executes. This week I ran two of those tools through a six-line sheet to see what we should have checked. What you leave with: a six-line sheet to fill in before your agent installs a link you were sent, and a worked example on two real tools. What changes (junior developer, PM, PO, designer, scrum master, Design System lead): installing an AI tool becomes a decision with a name on it, not a click. Why now: on October 30, 2026, two versions of a Claude Code extension were pulled after a backdoor was found. · · · <!--…