Hi, I was wondering what are the best practices when Claude code download tools to help build the agent. I've asked a security brief to have a view of what he installed , but I am not confortable to assess whether or not there is a risk. Any advice please?