vetting-skills-before-install

# Vetting skills before install: decide install, constrain, or deny with evidence Installing a skill or an MCP server hands untrusted instructions and untrusted code to an agent that acts on your behalf. Popularity and a clean README are not a review. This is the checklist that turns "it looks fine" into a verdict backed by evidence: what the artifact tells the model, what it is allowed to do, and what its code actually does on install and at runtime. It composes three audits and adds the code inspection that ties them together. ## When to use - You are about to add a third-party skill, MCP server, or marketplace entry. - You are re-reviewing an artifact after an update changed its code or manifest. - You need a defensible install decision, not a gut call. ## Scope check Vet artifacts you intend to run on your own agent, in a contained environment. Inspect bundled code statically before executing anything. If you can't name the authorization, stop. ## The loop 1. **Pin the exact artifact.** Record the source, the author, and the precise version or content hash. You vet one frozen artifact, not "the skill": a later version is a new review. Everything below refers to this pinned state, so an auto-update that replaces it voids the verdict. 2. **Audit the instruction surface.** Run the instruction-text lint over every field the model reads: hidden or invisible text, override and role-spoofing phrases, concealment directives, and instructions that steer the ...