How to Review an Agent Skill Before Installing It

What are you installing?

An agent skill is a folder of instructions and optional resources that an AI agent can load for a particular task. Review the folder as material that can influence your agent’s decisions and, where execution is supported, run code.

The Agent Skills overview describes reusable workflows loaded when relevant. Its format specification requires a SKILL.md file with a name and description; folders can also include scripts, references and assets. A valid format establishes structure. It does not establish that the contents suit your project.

This guide gives our recommended review process. It does not certify a particular skill or report a hands-on security test. The October 22 briefing covers the latest Agent Skills standards news; the checks here apply to the contents you actually download.

Start with the task you want to improve

Write down one repeated job and its expected output. For example: turn an existing internal procedure into a draft help article with source links. Decide which files the agent needs, where the draft should go and who reviews it. This gives you something concrete against which to judge the skill.

A skill that demands access to unrelated accounts or insists on publishing every draft may be a poor fit for that job. You can reject a mismatch without proving malicious intent. Keep the first task small enough that you can inspect the result yourself.

Read the instructions and follow their references

Inspect SKILL.md before enabling the skill. Look for the task it claims to handle, when it activates, the commands it asks the agent to execute and any instructions to send data elsewhere. Follow references to bundled files so that important behavior does not stay hidden behind the main description.

• Scope: Does it activate for the work you intended, or for almost every request?
• Output: Does it create a draft, edit existing records or publish externally?
• Data: Which files, accounts and remote endpoints does it use?
• Authority: Does it request approval before consequential actions?
• Conflict: Does it tell the agent to bypass your instructions or conceal actions?

Treat instructions to disable safeguards, expose secrets or hide execution as reasons to stop the review. A reassuring description does not cancel the behavior in another file.

Inspect scripts and dependencies separately

Open bundled scripts before running them. Identify network requests, file writes, subprocesses and installation commands. Check whether a dependency is pinned to a version and whether the workflow downloads additional code at runtime. Save the revision you reviewed so an update can be compared later.

If you cannot explain what a command does, leave it unexecuted while you investigate. For a document workflow, ask why it needs broad shell access or credentials. There may be a legitimate reason, but the reason should follow from the task.

Check what your agent actually enforces

The client implementation guide discusses trust decisions for project skills and differences between local and hosted agents. Inspect your own client’s behavior: where it discovers skills, how activation works and which permissions govern execution.

A sentence saying “only read this folder” is a workflow instruction. Check whether the runtime also restricts file access. Similarly, a request to ask before sending is useful only if the actual tool and approval path behave as you expect. Do not assume every client interprets optional metadata identically.

Run a bounded trial and inspect the result

Use an isolated checkout or a temporary working folder with sample material. Keep production credentials out of the trial. Request a draft and state a stopping point before any external publication. Inspect the changed files, outputs and commands afterward.

For a help-article skill, verify button labels against the app, open any generated screenshots and check whether they depict a live interface or reconstructed markup. For a code explanation skill, follow source references and test whether its explanation matches the actual behavior. A polished artifact can still contain incorrect claims.

Keep the review useful after installation

Record the source, revision, intended task and permissions used. Recheck changes when the skill updates, particularly new dependencies, broader activation rules and new external services. Remove unused skills so the available catalog remains understandable.

The first success criterion is simple: the skill produces a reviewable result for your chosen task with access you can explain. For more context, read when agent skills help and how to test agents against prompt injection. Reviewed October 23, 2026.