All three MCP servers used `npx -y <package>` without version pins,
causing npx to auto-install the latest version on each invocation.
A compromised or breaking release would silently affect all users.
Pinned to current stable versions verified against npm registry:
- @playwright/mcp@0.0.70
- @upstash/context7-mcp@2.1.8
- deepwiki-mcp@0.0.6
Update these pins deliberately when upgrading rather than auto-pulling.
Co-Authored-By: Claude Code <noreply@anthropic.com>
hooks.py logs full hook event data (including tool_input, which may contain
file contents or command arguments) to .claude/hooks/logs/hooks-log.jsonl.
This log file was not excluded from git, creating a risk of accidentally
committing sensitive data such as file contents passed to Write/Edit tools
or command arguments passed to Bash.
Added .claude/hooks/logs/ to .gitignore to prevent accidental commits.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Two agent files both declared `name: time-agent` with different implementations:
- `.claude/agents/time-agent.md` (root): PKT, UTC+5 (Pakistan Standard Time)
- `agent-teams/.claude/agents/time-agent.md` (agent-teams): Dubai GST, UTC+4
When both scopes are active, Claude Code may invoke the wrong time-agent —
serving PKT time when a Dubai command expects GST, or vice versa.
Renamed the root agent's `name` from `time-agent` to `time-agent-pkt` so
the two agents are unambiguous. The agent-teams variant retains `name: time-agent`
since `agent-teams/.claude/commands/time-orchestrator.md` explicitly invokes it
by that name for Dubai time display.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The command was missing its `description` field in the YAML frontmatter
(only `model: haiku` was present). Without a description, Claude Code
cannot surface this command in the `/` slash-command menu, making it
non-discoverable by users.
Co-Authored-By: Claude Code <noreply@anthropic.com>
claude[bot]andClaude Code