Every week there's a new post recommending an MCP server, a Claude skill, or some agent plugin you should install right now. Screenshot of the output, a line about how it changed their workflow, and the life's saver it has become. Never a word about what the thing actually has access to, who wrote it, or what happens if it's malicious.
We spent almost the last decade learning this lesson the hard way with npm. Typosquatted packages, compromised maintainer accounts, postinstall scripts quietly exfiltrating environment variables. We got better at it: lockfiles, npm audit, dependency scanning in CI, actual policies about what gets approved.
Then AI tooling showed up and all of that discipline evaporated.
The install-first, ask-never culture
Watch how these recommendations actually get made. "Install this MCP server, it lets Claude read your Slack." Cool, what permissions does it request? Nobody says. Who maintains it? Unclear. Is the code even public? Sometimes not.
