skills.rest
bomday
bomdayCOMMUNITY
Explore all skills by this author →
GitHub

skill-installer

Install community skills after user approval and trust checks.

1|Updated Jun 27, 2026
Search Tags:#skill installation#user approval#security checks#license verification#freshness validation
One-click install
npx skills add https://github.com/bomday/projetao-tatico --skill skill-installer-bomday
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-installer
Source: https://github.com/bomday/projetao-tatico/tree/main/claude-for-legal/legal-builder-hub/skills/skill-installer
Command: npx skills add https://github.com/bomday/projetao-tatico --skill skill-installer-bomday

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires skills-qa, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the challenge of safely installing community skills by ensuring explicit user approval and conducting detailed checks before installation.

Core Features & Use Cases

  • Explicit User Approval: Requires the user to explicitly confirm the installation after reviewing the SKILL.md file.
  • Structured Trust Checks: Performs checks on the skill's hooks, MCP servers, tool permissions, and file-write targets.
  • skills-qa Integration: Runs the skills-qa skill against the candidate for additional verification.
  • License Verification: Verifies the skill's license against the allowlist to ensure compliance.
  • Freshness Validation: Checks the skill's freshness against declared dates and sources.
  • Role-Aware Routing: Routes decisions to the appropriate person (e.g., attorney) based on the user's role.
  • Install Logging: Records the installation details in an install log for audit purposes.
  • Version Tracking: Records the version of the skill for updates and version control.
  • No Malicious Code: The Skill is designed to prevent malicious code execution through various checks and controls.

Quick Start

Use the skill-installer to install a new community skill by providing the skill name or registry URL and following the on-screen instructions.

Frequently Asked Questions about skill-installer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely install community skills with explicit user approval?▼

Securely installing community skills requires explicit user approval, structural trust checks on hooks and tool permissions, license verification, and freshness validation before execution. The installer logs all installation details for audit purposes.

What checks are needed to prevent malicious code execution during skill installation?▼

Preventing malicious code execution during skill installation involves structured trust checks on hooks, MCP servers, tool permissions, and file-write targets. It also requires running QA verification and validating the skill's freshness.

How do I verify a community skill's license and freshness before installing it?▼

Verifying a community skill's license and freshness involves checking the license against an allowlist for compliance and validating the skill's freshness against declared dates and sources before proceeding with installation.

Does the skill installation process support role-based decision routing for approvals?▼

Role-based decision routing routes installation approvals to the appropriate person, such as an attorney, based on the user's role. This ensures proper authorization before final execution and install logging.

Do I need the skills-qa dependency to run trust checks on a new skill?▼

You need the skills-qa dependency to run additional verification against the candidate skill. The installer integrates it directly to perform thorough checks alongside structural trust validation and license verification.

What are the limitations of automated skill installation without human-in-the-loop approval?▼

Automated skill installation without human-in-the-loop approval bypasses explicit user confirmation of the SKILL.md file. This removes the final security gate, increasing the risk of executing unverified or malicious code.

Related Skills

Explore More Software Engineering Skills→
fredrick84823fredrick84823
2

extract-skill

Reviews pending skill candidates and merges duplicates before forwarding them to the IDE for approval and creation.

Community
Intermediate
HugopeckHugopeck

update-skills

Refresh installed Track skill clones with fast-forward-only git pulls.

Community
Intermediate
anthropicsanthropics
9.1k

skill-installer

Install community skills after allowlist checks and explicit user approval.

Official
Advanced
InverterNetworkInverterNetwork

mcp-oauth-remote-gateway

Guides manual OAuth 2.1 PKCE token exchange and file-based credential storage for MCP servers on remote gateways.

Official
Advanced