skills-discovery

What problem does it solve? Installing third-party AI skills without inspection exposes your environment to unsafe shell commands, sensitive file access, and untrusted network calls. This Skill finds relevant external skills from the skills.sh ecosystem and enforces a mandatory security review before any installation. ## Core Features & Use Cases - Domain-Based Discovery: Detects your project type (software, business, personal) from files like package.json or go.mod and suggests relevant skills via npx skills find. - Mandatory Security Gate: Fetches a candidate skill's SKILL.md from GitHub, scans shell commands, file access, and network patterns, then issues a PASS, WARN, or BLOCK verdict before install. - Human-in-the-Loop Install: Installs approved skills with npx skills add only after explicit user confirmation, and lists installed skills on demand. - Use Case: While working in a React project, run the discovery command to get framework-specific skill suggestions, review a candidate's security report, and install it only after it passes inspection. ## Quick Start Ask the assistant to suggest and securely install external skills relevant to this project from skills.sh.