skills.rest
PolliticalSolutions
PolliticalSolutionsCOMMUNITY
Explore all skills by this author →
GitHub

skill-installer

Validates allowed sources and awaits explicit human approval before installing third-party skills from URLs or registries.

Updated Dec 4, 2025
Search Tags:#security scanning#prompt injection#skill installation#trust verification#allowlist#human approval#license gating
One-click install
npx skills add https://github.com/PolliticalSolutions/political-portal --skill skill-installer-polliticalsolutions
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-installer
Source: https://github.com/PolliticalSolutions/political-portal/tree/main/.claude/skills/legal-builder-hub/skill-installer
Command: npx skills add https://github.com/PolliticalSolutions/political-portal --skill skill-installer-polliticalsolutions

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Skill installation is risky because third-party instructions can contain prompt injections or attempt unwanted file/network access. This Skill makes community skill installs safer by showing the raw SKILL.md, running structural and QA checks, and requiring explicit human approval before any files are written.

Core Features & Use Cases

  • Allowlist-first gating: Reads an allowlist file before fetching anything, refusing in restrictive mode when the registry/publisher is not permitted.
  • Raw-skill transparency: Displays the full SKILL.md content to the user and calls out common injection patterns and suspicious content.
  • Structural trust checks + skills-qa: Verifies execution surface risks (hooks, MCP/tool permissions, network calls, and file-write targets) and runs skills-qa to produce a quality/safety verdict.
  • Human approval gate: Requires a fresh, explicit “yes” typed by the user before copying any files and updating install logs.
  • Safety-minded install flow: Encourages fetching/scanning in a read-only subagent in restrictive mode to reduce the risk of write-capable exploitation.

Quick Start

Run the installer with the registry URL or skill name you want to install, then read the raw SKILL.md and type yes when you explicitly approve the install.

Frequently Asked Questions about skill-installer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely install community skills without risking prompt injection?▼

To safely install community skills, an allowlist-first gating mechanism reads a permitted sources file, displays the raw SKILL.md content, runs structural trust and skills-qa checks, and requires explicit human approval before writing any files to disk.

What steps are involved in the human approval gate for skill installation?▼

The human approval gate requires you to review the full raw SKILL.md disclosure and type a fresh, explicit "yes" before the installer copies any files or updates install logs, mitigating unauthorized side effects.

What does allowlist-based license gating check before fetching a third-party skill?▼

Allowlist-based license gating checks an allowlist file before fetching anything and refuses installation in restrictive mode when the registry or publisher is not explicitly permitted on the list.

Can I verify execution surface risks like hooks and network calls before installing a skill?▼

Yes, structural trust checks verify execution surface risks including hooks, MCP and tool permissions, network calls, and file-write targets, while skills-qa produces a quality and safety verdict prior to installation.

How are suspicious content and injection patterns called out during skill installation?▼

During skill installation, raw-skill transparency displays the full SKILL.md content to the user and actively calls out common prompt injection patterns and suspicious content found in the third-party instructions.

When should I use a read-only subagent for community skill installation?▼

You should use a read-only subagent in restrictive mode during community skill installation to reduce the risk of write-capable exploitation while fetching and scanning third-party skill content.

Related Skills

Explore More Legal & Compliance Skills→
ran-isenbergran-isenberg
678

ai-dlc-rule-details

Load and validate AI-DLC rule detail artifacts before file generation.

Community
Advanced
heyAyushhheyAyushh
3

find-skills

Discover and install agent skills using the Skills CLI.

Community
Intermediate
alexchloualexchlou
2

skill-installer

Fetch, display, and analyze SKILL.md content before approving installation.

Community
Intermediate
yachelayachela

skill-installer

Install third-party skills after allowlist checks, SKILL.md review, and user approval.

Community
Advanced