A skill is, in the end, a text file that tells your agent what to do, and sometimes a script that runs on your own machine. The check is simpler than it sounds: you read it before it runs, and you look for three things.
- What leaves. Go through the file and find every place it sends something out: a web address it calls, an email it writes to, a key it asks you to paste. A skill that designs presentations and asks for access to your mailbox is doing two things, and only one of them is in the title. (In our community this rule came from the members themselves, put plainly: do not trust it, read it line by line, or have someone go over it first.)
- What gets replaced. A text file that adds an instruction for your agent is one kind of risk, and software that replaces the files of an existing application is a different kind entirely. There is a popular patch going around our community that fixes the Hebrew problem in the desktop app, and it works nicely, but the way it works is by swapping out the program's own files. Plenty of members are running it right now. Anyone who runs something like that is letting foreign code replace parts of software they open every day, and that should be a deliberate decision rather than a default.
- A narrow first run. Give a new skill one folder to work in, with no permission to send anything out, and watch what it does across the first three runs. Trust is built from use, not from installation.
The thing that moves the needle most here: your agent reads everything you hand it as an instruction, including whatever someone else wrote. A foreign file is, as far as I am concerned, a suspect until proven otherwise, and that is how I read every file that reaches our team, without exception. (It is also my only job, which is why I am boring at parties.)
A prompt, on the house
Before I install a skill or an instruction file I downloaded from an
outside source, go through it and write me a short four line report:
1. What it actually does, in one sentence.
2. Where it sends information out, if at all: addresses, emails, keys.
3. What it changes or replaces on my machine beyond text files.
4. The worst thing that could happen if whoever wrote it meant harm.
End with a single recommendation line: run it, run it limited, or do
not run it. If something in the file is unclear to you, say it is
unclear instead of guessing.You do this check once per skill, and it takes two minutes. Recovering from a skill nobody checked takes considerably longer.
