Has an ai agent ever introduced a deprecated library into your project without you noticing?
by•
Asked an agent to quickly add a web-scraping utility, and it wrote clean working code using an old npm package that hasn't been maintained in four years. The code worked perfectly in local testing, but security scanners flagged it the second we opened a pull request.
how do you restrict your development agents from introducing outdated or unvetted external dependencies?
16 views
Replies
Telling the agent not to never held for me either. What works is moving the check out of the model and into a script that runs on its own, so it doesn't depend on the agent remembering. I've got 81 hook scripts in my global settings now. My rule is that a mistake that happens twice gets a hook, not a reminder.
same thing shows up with mcp servers.. five of the archived reference ones are still in npm's top 30 mcp packages. rules in the prompt never held for me, hooks did, so i'd put the check on any diff that touches package.json instead of asking the agent nicely. does your scanner run before the agent commits or only at the pr?