skills.rest
anthropics
anthropicsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

skill-installer

Install community skills after allowlist checks and explicit user approval.

9.1k|1.8k|Updated Apr 21, 2026
Search Tags:#skill installation#supply chain security#license compliance#human approval#prompt injection defense#allowlist enforcement#MCP connectors
One-click install
npx skills add https://github.com/anthropics/claude-for-legal --skill skill-installer-anthropics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-installer
Source: https://github.com/anthropics/claude-for-legal/tree/main/legal-builder-hub/skills/skill-installer
Command: npx skills add https://github.com/anthropics/claude-for-legal --skill skill-installer-anthropics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It lets users install third-party community skills while reducing prompt-injection and supply-chain risk by showing the raw skill instructions, running structural checks, and gating installation behind explicit approval.

Core Features & Use Cases

  • Allowlist-first source control: Reads an administrator allowlist before fetching any community skill, and refuses or warns based on restrictive vs permissive mode.
  • Raw SKILL.md transparency: Displays the full, un-summarized SKILL.md so the user can review what the skill will instruct at runtime.
  • Structural trust verification: Checks execution surface (hooks, MCP connectors, tool permissions, file-write targets, and network calls) and cross-checks connectors against the allowlist.
  • skills-qa heuristic scoring: Runs an automated quality and injection heuristic review and surfaces verdicts before any install occurs.
  • Human-in-the-loop install gate: Requires fresh explicit approval before any files are written to disk, with an option to show everything that would be installed.

Quick Start

Use the skill-installer to install a community skill by running the command you would normally use like: install the skill named "example-skill" from your watched registry.

Frequently Asked Questions about skill-installer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely install third-party community skills without prompt injection risk?▼

To safely install community skills, you need an installer that displays the raw SKILL.md instructions, runs structural trust checks on execution surfaces, and gates filesystem writes behind explicit user approval to mitigate prompt injection risk.

What is an allowlist gate for skill installation?▼

An allowlist gate is a pre-fetch policy enforcement mechanism that checks a community skill's source registry and MCP connectors against an administrator-approved list, refusing or warning the user if the source is not explicitly permitted.

How do I validate MCP connectors and execution surfaces before installing a skill?▼

Validating MCP connectors and execution surfaces involves structural trust checks that inspect tool permissions, file-write targets, network calls, and hooks, cross-referencing any connectors against the configured allowlist before proceeding.

Can I review the raw SKILL.md content before a community skill is installed?▼

Yes, the installation process must display the full, un-summarized raw SKILL.md content so you can review exactly what the skill will instruct at runtime before any files are written to disk.

Does license compliance check automatically block restrictive third-party legal workflow skills?▼

License compliance checks evaluate restrictive policy and license constraints during the pre-install trust phase, blocking or warning the user based on the specific limitations of the third-party legal workflow skill being fetched.

What are the limitations of automated heuristic scoring for skill supply chain security?▼

Automated heuristic scoring provides a quality and injection verdict to surface potential supply chain security issues, but it does not replace the mandatory human-in-the-loop approval step required before any installation occurs.

Related Skills

Explore More Legal & Compliance Skills→
Bossmann007Bossmann007

registry-browser

Search legal skills in watched registries and preview SKILL.md files.

Community
Basic
kenlckkenlck
5

review-skill

Audit local or installed skills against write-a-skill guidelines and generate a remediation report.

Community
Intermediate
bomdaybomday

skill-installer

Install community skills after user approval and trust checks.

Community
Advanced
RicherTunesRicherTunes
2

security-compliance

Implement CodeQL workflows, Dependabot configurations, and security policy documentation for repositories.

Community
Advanced