Skills and agents · Checklist
Before you install a skill or plugin: a safety checklist
- Tools
- Multi-tool
- Audience
- People getting started with AI
- Topic
- Skills and agents
You’ll finish with: an installation decision with permissions and removal steps recorded.
A GitHub page can hold a useful skill, a whole software project or a rather ambitious weekend experiment. Read what you are installing before you run it. A large star count is not a background check.
Set up
Allow 20 minutes. Use a browser to inspect a repository, its README, licence and files. Start with the official Agent Skills examples linked below; downloading text does not require executing an installer.
Try this example
FICTIONAL PRACTICE MATERIAL
Fictional review: a skill has SKILL.md, scripts/send-report.py and no licence file. Its README says it summarises notes, but the script also sends an email. You only want a local draft.Do the task
- Find the owner, licence, supported host and installation instructions.
- Inspect scripts, dependencies and requested access as well as the friendly README.
- Choose install, inspect further or skip, with a reason linked to your actual task.
Your reusable prompt
Review this fictional package description. List the gap between its advertised purpose and executable behaviour. Create an install decision with licence, access, host compatibility, test input and removal plan. Do not run anything.
PRACTICE INPUT
Fictional review: a skill has SKILL.md, scripts/send-report.py and no licence file. Its README says it summarises notes, but the script also sends an email. You only want a local draft.Refine your result
Explain why recent commits or many stars would not resolve the email-sending mismatch. Offer a text-only alternative for the local draft.Check the result
Sending email exceeds the stated task. An absent licence does not grant unrestricted reuse. A README alone cannot prove what all included code does; stop if you cannot explain the access being granted.
Save and reuse
Keep your review and the exact repository version. If you only copy a permitted text procedure, label it as a prompt adaptation rather than an installed plugin.
Sources and notes
- Downloading files from a GitHub repository Checked 2026-10-05
- What a repository licence permits Checked 2026-10-05
- Agent Skills file specification Checked 2026-10-05
- The practice input and teaching prompt are original 5HO material. Examples are fictional; they are not screenshots or claims of a completed real-world task.
- Official documentation supports the relevant product concepts. Setup availability depends on your account; where a guide offers a fallback, it does not prove the connected capability worked.