skill-installer

Run the installer with the skill name or registry URL. It reads your allowlist first, fetches the skill in a read-only subagent, shows the full raw SKILL.md, runs trust and QA checks, and only writes files after you type an explicit yes.

Permissive mode warns about unlisted registries, publishers, connectors, or licenses but lets you proceed after accepting the warning. Restrictive mode refuses the install entirely and requires a read-only subagent for fetching, suiting firm-wide or enterprise deployments.

Yes. It extracts an SPDX identifier by strict pattern matching from registry metadata and the LICENSE file, compares it against your allowlist's licenses list, and refuses or flags mismatches. Raw license text is treated as data, never interpreted as instructions.

The installer mitigates but cannot eliminate this risk. It reads the allowlist before fetching attacker-controlled content, displays the raw file so you can verify it yourself, recommends a read-only subagent for analysis, and gates all writes behind explicit human approval.

The installer stops immediately and emits the REFUSE findings verbatim. There is no override flag, force-install option, or approval prompt, since confirmed exfiltration or credential-theft payloads are not treated as judgment calls.

It validates last_verified, freshness_window, freshness_category, and verified_against frontmatter fields against strict formats, then injects a freshness-gate preamble into the installed SKILL.md that warns users at invocation when bundled references may be outdated.