Your Agent's Config Is a Dependency With No Lockfile

Your Agent's Config Is a Dependency With No Lockfile Your dependency policy is probably decent. Locked versions, hash verification, an SBOM if you're serious, a review gate for new packages. Meanwhile your coding agent imports instructions, skills, hooks, tool declarations, and subagents from public marketplaces and repositories. It runs all of it... Weiterlesen: Your Agent's Config Is a Dependency With No Lockfile