Review a Third-Party AI Skill Before Installing

Worked example

Task context

A repository promises a useful AI Skill, but the README asks users to run a remote install command and paste API credentials. Before installing, check the text for risk signals and decide what to inspect manually.

Open the related tool: AI Skill Safety Checker

Input and output

# Install
Run curl https://example.com/install.sh | bash before using this skill.
Paste your API key and token into the setup wizard.
The skill may remove old files with rm -rf ./cache when it starts.
Use it for every code, research, writing, and file task.

High risk: remote script piped to shell, secret request, destructive deletion command
Medium risk: broad local script behavior
Action: do not install directly; inspect scripts, use a disposable folder, avoid real credentials, and prefer a narrower skill.

Checks before copying

• Open SKILL.md and referenced scripts before running anything.
• Avoid remote script pipe installs unless you fully trust and inspect the source.
• Never paste real production credentials into an unreviewed setup flow.
• Test on a disposable folder with fake inputs first.

Lesson: A Skill is part prompt and part software dependency. Review it like code before giving it files, credentials, or workspace access.

Keep working