Why isn't there a tool that would check those dangerous places, such as git hooks, VSCode and Claude commands that launch automatically, and warn the user of consequences, showing the hook code, allowing to allowlist this single repo if the user deem it secure? I'd say it should be a job of AV/EDR/XDR easily... Or a dedicated software with a highly protected service, and a tray/UI part.