skill-installer

Safe skill installation requires an allowlist check, raw SKILL.md disclosure, structural trust scanning, and a human approval gate before writing files. This process validates publisher identity and flags suspicious instructions to prevent prompt injection in third-party skills.

Allowlist gating validates the registry or publisher against an administrator-controlled list and checks declared licenses against approved SPDX values. This license compliance check ensures only authorized third-party skills are fetched and installed in the local environment.

The skill installation process displays the complete raw SKILL.md file to the user before proceeding. It flags prompt-injection patterns and suspicious instructions, requiring an explicit confirmation to ensure transparent human-in-the-loop review of the skill definition.

Yes, structural trust checks scan MCP connectors, hooks, tool permissions, and file-write or network surfaces. The installer also runs skills-qa verification to surface heuristic findings before any files are written to your environment.

Automated skill installation relies on heuristic structural scanning and predefined allowlists, meaning it cannot detect novel or obfuscated prompt injection attacks. Installation also pauses for a mandatory human approval gate, which cannot be bypassed for automated or headless deployments.

Explicit user approval prevents unauthorized or malicious file writes by enforcing a human-in-the-loop confirmation gate. The installer requires a fresh confirmation response after displaying the raw SKILL.md and trust scan results to ensure controlled, audited installation.