También en español: rosmarops.com/es/blog/antes-de-decirle-a-tu-agente-que-lo-instale/ · També en català: rosmarops.com/ca/blog/abans-de-dir-al-teu-agent-que-ho-instal-li/
More and more open-source tools install in one sentence. You tell your agent “set this up from this repo”, and it does. It’s convenient, and I do it too. But what gets installed isn’t just a program. It’s instructions and code that your agents are going to follow.
Take Kanvas. It’s a shared task board between you and your coding agents: the agents update it, and you approve and review in the browser. It’s a good project, MIT-licensed and well documented, and that’s exactly why I’m using it as an example: it says clearly what it leaves behind. The point here is the pattern, not the project.
You install it by telling your agent to run uvx kanvas-board init.
What it leaves in your project
- the board,
kanvas.json; - a skill in
.agents/skills/kanvas/, with its ownkanvas.py, which your agents run; - a copy of its
SKILL.mdfor Claude Code, in.claude/skills/kanvas/; - an
AGENTS.md, if you didn’t have one.
And outside the project
%LOCALAPPDATA%\Kanvas\boards.json, with the boards you have open and whether they are open to other devices;- if you choose, a scheduled task that starts it when you sign in;
- if you choose, your boards open to your Tailscale network without a password. Its README says it plainly: “anyone on your Tailscale network can open and edit your boards”.
It also has a YOLO mode you can turn on, in which agents complete a chain of tasks without your review, except the last one.
None of this is hidden: it’s all in the README. The question is whether you read it before you said “install it”.
Why it matters
What a tool installs for your agents (skills, instructions, scripts) is code and instructions that your agents are going to follow. Whoever can rewrite it steers your agents.
That’s not a flaw of one tool. It’s what a skill is. And it’s why the question before installing isn’t only “is this project good?”, but also “what will my agents read and run from now on, and who else can change it?”.
Before you say “install it”
- Which files does it write into your project, and which of them will your agents read or run?
- What does it leave outside the project: settings, scheduled tasks?
- Does anything open to the network, and who can reach it?
- Is there a mode in which agents act without your review?
What RosmarOps sees
Today RosmarOps sees AGENTS.md and new scheduled tasks. Skills, and Kanvas itself, will come in a future version.
I wrote this with AI assistants. The machine, the findings and the decision to publish are mine.