I think it’s legitimate to ask why these dependencies are necessary. LLMs have created whole new classes of vulnerabilities, and things like a GitHub client (which downloads arbitrary data/code) and a templating engine (which executes it) expose an even larger attack surface.

If someone’s going to get RCE on my machine, I don’t want it to be through the silly Clippy LLM UI, you know?