First Seen
Feb 18, 2026
Last Scanned
Feb 22, 2026
Findings
2
Score
100/100
Findings (2)
Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation
add remotion-dev/skills -a claude-code -yRemove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.
Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.
Detects npx with -y flag that bypasses user confirmation for package installation
npx skills add remotion-dev/skills -a claude-code -yReplace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.
Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.