> VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, and Bundler all support config files that can carry a shell command.

I think they, and the CIA, call it a feature. Just like messenger apps which try to "execute" every "image file" or link thrown at them.