discover

Skill discovery prioritizes local skills directories first, then queries GitHub and npm registries as needed. It inspects top-3 candidate packages by reading their documentation, applies transparent weighted scoring, and recommends the best fit without triggering automatic installation.

No, automatic installation is strictly blocked to ensure safety. The discovery process enforces an explicit approval step before installing any external package, rejects low-scoring candidates, and blocks suspicious npm packages by checking their lifecycle scripts.

The best way to decide is to inspect the top-3 candidate packages and review their transparent weighted scores. If trusted external skills match the required capabilities and pass security checks, installing them saves development time compared to building a custom pipeline manually.

Version pinning locks the selected external skill to a specific package release during installation. This deterministic discovery requirement ensures pipeline stability by preventing unexpected updates from external GitHub or npm sources after the explicit approval step.

Yes, package evaluation includes security checks for npm lifecycle scripts. The discovery process flags suspicious candidates, blocks low-scoring packages, and enforces strict safety gating to prevent risky changes before any explicit installation approval is granted.