# Before you install a skill or plugin: a safety checklist

Original 5HO practice material. Fictional example. Reviewed 5 October 2026.

## Useful result

You'll finish with an installation decision with permissions and removal steps recorded.

A GitHub page can hold a useful skill, a whole software project or a rather ambitious weekend experiment. Read what you are installing before you run it. A large star count is not a background check.

## Set up

Allow 20 minutes. Use a browser to inspect a repository, its README, licence and files. Start with the official Agent Skills examples linked below; downloading text does not require executing an installer.

## Practice input

Fictional review: a skill has SKILL.md, scripts/send-report.py and no licence file. Its README says it summarises notes, but the script also sends an email. You only want a local draft.

## Do the task

1. Find the owner, licence, supported host and installation instructions.
2. Inspect scripts, dependencies and requested access as well as the friendly README.
3. Choose install, inspect further or skip, with a reason linked to your actual task.

## Prompt

Review this fictional package description. List the gap between its advertised purpose and executable behaviour. Create an install decision with licence, access, host compatibility, test input and removal plan. Do not run anything.

## Refine

Explain why recent commits or many stars would not resolve the email-sending mismatch. Offer a text-only alternative for the local draft.

## Expected checks

Sending email exceeds the stated task. An absent licence does not grant unrestricted reuse. A README alone cannot prove what all included code does; stop if you cannot explain the access being granted.

## Save

Keep your review and the exact repository version. If you only copy a permitted text procedure, label it as a prompt adaptation rather than an installed plugin.

## Sources

- Downloading files from a GitHub repository: https://docs.github.com/en/repositories/working-with-files/using-files/downloading-source-code-archives
- What a repository licence permits: https://docs.github.com/articles/licensing-a-repository
- Agent Skills file specification: https://agentskills.io/specification