skill-installer

To verify a community skill is safe before installing, this tool fetches the raw SKILL.md file, performs structural trust checks, and runs QA scans on hooks, MCP connections, file writes, and network calls to identify potential security risks requiring human approval.

When adding a third-party skill, you should check for risks involving hooks, MCP connections, file writes, and network calls. This validation process analyzes these specific components to assess the skill's safety and structural integrity prior to deployment.

Yes, you can review the full SKILL.md content before deployment. The tool fetches and displays the complete raw markdown content from the provided skill URL or registry, ensuring full transparency for manual inspection before you approve the installation.

Yes, importing community skills requires manual approval. The secure import process displays the raw SKILL.md content and automated inspection results, pausing the installation until a human explicitly reviews and approves the validation findings.

To perform a trust check on a skill fetched from a registry, provide the skill URL to initiate a fetch. The system automatically scans the retrieved SKILL.md for structural anomalies and potential security threats, presenting a risk assessment for human review.

Automated QA scans for community skills are limited to analyzing structural components like hooks, file writes, and network calls within the SKILL.md. They cannot assess logical flaws or contextual misuse, which is why human approval is required before final installation.