Skill Quality Gate
Use before copying or enabling any external skill, plugin, hook, or MCP.
Procedure
- Identify the source URL, commit/tag, license, maintainer, recent activity, and intended capabilities.
- Read all
SKILL.md, manifests, install scripts, hooks, and referenced scripts before execution.
- Search for network calls, secret access, credential files, shell execution, destructive commands, telemetry, obfuscated code, and unrelated file writes.
- Check whether the description matches the repository behavior.
- Classify risk as
low, medium, or high, and list required approvals.
- Produce a decision:
accept, adapt, sandbox, or reject.
Required output
Include source, version, license, capabilities, permissions, risks, missing evidence, adaptation work, and a bounded verification plan.
Never install an external artifact merely because it has many stars. Popularity is discovery evidence, not security evidence.
1---2name: skill-quality-gate3description: Avalia skills, plugins e MCPs antes da adoção, verificando formato, dependências, permissões, riscos de supply chain e critérios de validação.4---56# Skill Quality Gate78Use before copying or enabling any external skill, plugin, hook, or MCP.910## Procedure11121. Identify the source URL, commit/tag, license, maintainer, recent activity, and intended capabilities.132. Read all `SKILL.md`, manifests, install scripts, hooks, and referenced scripts before execution.143. Search for network calls, secret access, credential files, shell execution, destructive commands, telemetry, obfuscated code, and unrelated file writes.154. Check whether the description matches the repository behavior.165. Classify risk as `low`, `medium`, or `high`, and list required approvals.176. Produce a decision: `accept`, `adapt`, `sandbox`, or `reject`.1819## Required output2021Include source, version, license, capabilities, permissions, risks, missing evidence, adaptation work, and a bounded verification plan.2223Never install an external artifact merely because it has many stars. Popularity is discovery evidence, not security evidence.
IAPro-Community