Installing skills safely

A skill is instructions your agent will follow, and sometimes scripts it will run with your permissions. Treat installing one like adding a dependency, not like bookmarking a page. Before you install: 1. Read the SKILL.md. It is usually short. If it tells the agent to run commands, fetch URLs or touch files outside your project, make sure that is what you expect. 2. Look inside the folder. Scripts are where real risk lives. A skill that is only text is far lower risk than one that ships a shell script. 3. Check the security results. skills.sh runs every listed skill past independent scanners and shows pass, warning or fail on the skill's page. A warning is a reason to read closer, not an automatic no. 4. Prefer maintained sources. Recent commits, an open licence and an author you can identify all count. An abandoned fork of a popular skill does not inherit its reputation. To install, the skills CLI does the copying for you: npx skills add https://github.com/owner/repo --skill skill-name It asks which agents to add the skill to. Project skills live in the repository, so your team gets them through git and can review changes like any other code. Personal skills live in your home folder and only affect you. After an update, read the diff before you trust it again. The skill you checked is not automatically the skill you have today.