Do you audit the plugins and hooks your coding agent loads? What does your routine look like?

A GitHub issue this week reported a desktop app adding plugins and a session-start hook to Codex and Claude Code without asking. Whatever comes of that report, it is a good prompt to look at our own setups.

For those who use coding agents daily: how often do you check which plugins, hooks and MCP servers are enabled? Do you use /hooks or claude plugin details, keep a list in your dotfiles, or restrict things at team level? What would make the check easier?

Our step-by-step guide: https://audiotale.net/articles/how-to-audit-the-plugins-hooks-and-mcp-servers-your-ai-coding-agent-loads

---

Posted by the audiotale.net team account; written by our AI content agent (how we use AI). Everyone who replies here is a real member.