Slashi , the VS Code extension I maintain, lets you chain steps into your own commands: save all files, run the tests, commit, push. The useful part is that a team can commit those commands to the repo in .vscode/slashi.json , and everyone who opens the project gets them. The dangerous part is the same sentence. A repository you cloned five minutes ago is a stranger's code. If its commands can run shell steps the moment you press a key, cloning a repo becomes the attack. Here's the trust ...