skills.rest
stakwork
stakworkOFFICIAL
Explore all skills by this author →
GitHub

skill-installer

Evaluate and install community skills after allowlist, license, and security checks.

109|20|Updated Mar 7, 2025
Search Tags:#security review#license validation#prompt injection#skill installation#allowlist#community skills#mcp connectors
One-click install
npx skills add https://github.com/stakwork/stakgraph --skill skill-installer-stakwork
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-installer
Source: https://github.com/stakwork/stakgraph/tree/main/mcp/skills/legal-builder-hub/skill-installer
Command: npx skills add https://github.com/stakwork/stakgraph --skill skill-installer-stakwork

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents unsafe or unauthorized community skills from being installed without source review, structural trust checks, license validation, quality analysis, and explicit user approval.

Core Features & Use Cases

  • Allowlist Enforcement: Checks registries, publishers, MCP connectors, and licenses before fetching or installing a skill.
  • Security Review: Displays the complete raw SKILL.md and identifies prompt injection, unusual content, network calls, elevated tools, hooks, and risky file-write paths.
  • Controlled Installation: Runs skills-qa, applies role-aware routing and freshness validation, records an auditable install log, and installs only after a fresh approval.
  • Use Case: A legal team can evaluate a community skill from a watched registry, inspect every requested capability, verify its license and freshness metadata, and install it only when the configured controls permit it.

Quick Start

Use the skill-installer to review and safely install the requested community skill from its registry.

Frequently Asked Questions about skill-installer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely review and install community skills without risking prompt injection?▼

Safely review and install community skills by scanning the raw SKILL.md for prompt injection, network calls, and risky file-write paths before fetching. The skill-installer displays all content for source review and requires explicit approval prior to installation.

Can I enforce an allowlist for MCP connectors and publisher checks before skill installation?▼

Yes, you can enforce an allowlist for MCP connectors and publisher checks before skill installation. The skill-installer validates registries, publishers, and licenses against configured controls to prevent unauthorized writes and unreviewed execution.

What is the best way to validate licenses and freshness metadata for managed environment skill installation?▼

The best way to validate licenses and freshness metadata for managed environment skill installation is using role-aware routing and skills-qa analysis. The skill-installer applies these checks alongside structural trust validation before approving any community skill.

Does skill installation support auditable installation records for legal and compliance teams?▼

Yes, skill installation supports auditable installation records for legal and compliance teams. The skill-installer logs every approved installation, applying registry allowlists, license review, and MCP and hook inspection to maintain compliance.

How do I inspect hooks and elevated tools in a community skill before executing it?▼

Inspect hooks and elevated tools in a community skill by viewing the complete raw SKILL.md content. The skill-installer identifies unusual content, network calls, elevated tools, hooks, and risky file-write paths, preventing unreviewed execution until explicit approval is granted.

Related Skills

Explore More Legal & Compliance Skills→
archview-aiarchview-ai

openwebf-security-remote-content

Assess security risks of remote WebF content bundles and URL validation.

Official
Advanced
yachelayachela

skill-installer

Install third-party skills after allowlist checks, SKILL.md review, and user approval.

Community
Advanced
ZESCODEZESCODE

security-scan

Scan Claude Code configuration files for secrets and misconfigurations.

Community
Advanced
shiro123444shiro123444

pr-review

Automate PR review and compliance checks for MiniMax Skills.

Community
Advanced