# Security Considerations for Installing Third-Party Skills: A Complete Review Checklist

> Review security considerations before installing third-party skills. Verify activation, audit dependencies, and validate manifests to prevent attacks.

- Repository: [Ayoub Ghriss/i-have-adhd](https://github.com/ayghri/i-have-adhd)
- Tags: best-practices
- Published: 2026-08-18

---

**Before installing any third-party skill, verify explicit activation flags, check for always‑on opt‑ins, audit dependencies, and validate manifest consistency to prevent unauthorized code execution and supply‑chain attacks.**

Third‑party skills extend AI coding assistants with custom behaviors, but they also introduce potential security risks if not properly vetted. The `ayghri/i-have-adhd` repository demonstrates a security‑conscious skill architecture that you should use as a benchmark when evaluating any community‑contributed plugin. This guide walks through seven critical security considerations based on the actual implementation in this reference repository.

## Verify Explicit Activation Requirements

A secure skill should never execute code automatically upon installation. In `ayghri/i-have-adhd`, this protection is enforced through multiple layers.

### Disable Model Invocation Flag

The core skill definition in [`skills/i-have-adhd/SKILL.md`](https://github.com/ayghri/i-have-adhd/blob/main/skills/i-have-adhd/SKILL.md) explicitly sets:

```markdown
disable-model-invocation: true

```

This line (at line 4) ensures the skill remains dormant until the user deliberately triggers it with the `/i-have-adhd` command. Always confirm this flag exists in any skill's [`SKILL.md`](https://github.com/ayghri/i-have-adhd/blob/main/SKILL.md) before installing.

### Policy‑Driven Implicit Invocation Blocking

For OpenAI‑based runtimes, the repository includes [`skills/i-have-adhd/agents/openai.yaml`](https://github.com/ayghri/i-have-adhd/blob/main/skills/i-have-adhd/agents/openai.yaml) with this configuration:

```yaml
allow_implicit_invocation: false

```

Lines 6‑8 of this file prevent the Codex model from auto‑triggering the skill based on prompt content. Cross‑reference any skill's YAML policy files to confirm implicit calls are disallowed.

## Check the Always‑On Opt‑In Mechanism

Persistent activation should require deliberate user action, not default behavior.

In `ayghri/i-have-adhd`, always‑on mode is controlled by [`hooks/hooks.json`](https://github.com/ayghri/i-have-adhd/blob/main/hooks/hooks.json). The skill only enters always‑on state when the user manually creates a flag file at `~/.claude/.i-have-adhd-always`. This design pattern ensures:

- No silent activation after install
- The user consciously decides whether rules inject into every session
- The hook logic is isolated from core skill files

Before installing any skill, verify its documentation for how persistent activation works—default always‑on behavior is a red flag.

## Validate Manifest Consistency

Runtime‑specific manifests prevent tampering by binding version metadata to exact code states. The `ayghri/i-have-adhd` repository maintains these manifests across multiple directories:

| Runtime | Manifest Location |
|---------|-------------------|
| Claude | `.claude-plugin/` |
| Codex | `.codex-plugin/` |
| OpenCode | `.opencode/plugins/` |

According to [`AGENTS.md`](https://github.com/ayghri/i-have-adhd/blob/main/AGENTS.md) (lines 18‑26), these manifests list the skill version and metadata. Before installation, compare the version you're about to install against the repository's version map. A mismatch suggests potential tampering or an outdated copy.

## Audit for Hidden Secrets and Credentials

Credential leakage is a common supply‑chain risk. The `ayghri/i-have-adhd` repository contains zero `.env` files and no hard‑coded API keys. Required credentials must be supplied by the user after installation.

When reviewing any third‑party skill:

```bash

# Search for common secret patterns

grep -r -i "api_key\|secret\|password\|token" --include="*.py" --include="*.js" --include="*.yaml" .

```

Any embedded credentials should disqualify a skill from immediate installation pending author clarification.

## Run Dependency Vulnerability Scans

Third‑party libraries can introduce transitive vulnerabilities. For Node.js‑based skills like `ayghri/i-have-adhd`, dependencies are declared in [`package.json`](https://github.com/ayghri/i-have-adhd/blob/main/package.json).

Always execute a dependency audit before installing:

```bash

# Clone and audit

git clone https://github.com/ayghri/i-have-adhd
cd i-have-adhd
npm audit

```

Review any reported vulnerabilities and ensure the skill pins specific versions rather than using loose version ranges that could pull compromised updates.

## Inspect Installation Script Safety

The installation process itself can be an attack vector. [`INSTALL.md`](https://github.com/ayghri/i-have-adhd/blob/main/INSTALL.md) in `ayghri/i-have-adhd` shows read‑only installation patterns:

```bash

# Example: Safe installation via curl fetch

curl -fsSL https://raw.githubusercontent.com/ayghri/i-have-adhd/main/install.sh -o install.sh

# Review before executing

cat install.sh
bash install.sh

```

Dangerous patterns to avoid include:

- **Piped curl executions** (`curl ... | bash`) that prevent inspection
- **Remote script execution** without local verification
- **Privilege escalation** requests without clear justification

## Practical Pre‑Installation Verification Workflow

Apply this checklist to any third‑party skill before running installation commands like `agy plugin install`, `claude plugin add`, or `codex plugin install`:

```bash

# 1. Clone and inspect source

git clone <skill-repository-url>
cd <skill-directory>

# 2. Verify explicit activation flag

grep -i "disable-model-invocation" skills/*/SKILL.md

# 3. Check Codex policy (if applicable)

cat skills/*/agents/openai.yaml | grep allow_implicit_invocation

# 4. Audit dependencies

npm audit

# 5. Search for embedded secrets

find . -name "*.env" -o -name "*.secret" 2>/dev/null
grep -r "sk-[a-zA-Z0-9]" . --include="*.py" --include="*.js" 2>/dev/null

# 6. Compare manifest version with AGENTS.md

cat AGENTS.md | grep -A2 <skill-name>

```

## Summary

- **Explicit activation only** — Look for `disable-model-invocation: true` in [`SKILL.md`](https://github.com/ayghri/i-have-adhd/blob/main/SKILL.md) and `allow_implicit_invocation: false` in runtime YAML files
- **Always‑on requires opt‑in** — Confirm persistent activation needs manual flag file creation, not default behavior
- **Manifest versioning** — Verify version consistency across `.claude-plugin/`, `.codex-plugin/`, and other runtime manifests against [`AGENTS.md`](https://github.com/ayghri/i-have-adhd/blob/main/AGENTS.md)
- **Zero embedded credentials** — Reject skills with `.env` files or hard‑coded secrets in source
- **Dependency audit** — Run `npm audit` or equivalent before installing any skill with external packages
- **Read‑only install scripts** — Avoid piped curl executions; fetch, inspect, then run

## Frequently Asked Questions

### What is the most critical security check before installing a third‑party skill?

Verifying **explicit activation requirements** is the highest‑priority check. Confirm that `disable-model-invocation: true` appears in the skill's [`SKILL.md`](https://github.com/ayghri/i-have-adhd/blob/main/SKILL.md) and that runtime policies like `allow_implicit_invocation: false` prevent automatic execution. This single check eliminates the risk of malicious code running immediately upon installation.

### How can I tell if a skill will activate automatically in every session?

Check the skill's documentation and hook configuration for **always‑on opt‑in patterns**. Secure skills like `ayghri/i-have-adhd` require users to manually create a flag file (e.g., `~/.claude/.i-have-adhd-always`) rather than enabling persistent activation by default. Review [`hooks/hooks.json`](https://github.com/ayghri/i-have-adhd/blob/main/hooks/hooks.json) and installation docs for the specific mechanism.

### Should I trust a skill that uses `curl ... | bash` for installation?

No—this pattern prevents you from inspecting the script before execution. The `ayghri/i-have-adhd` repository demonstrates safer alternatives in [`INSTALL.md`](https://github.com/ayghri/i-have-adhd/blob/main/INSTALL.md): fetch scripts with `curl -o`, review the contents locally, then execute. Any skill insisting on piped execution warrants additional scrutiny or rejection.

### What files should I prioritize when auditing a skill's security?

Focus on five key files in this order: [`SKILL.md`](https://github.com/ayghri/i-have-adhd/blob/main/SKILL.md) (activation flags), runtime YAML configs like [`openai.yaml`](https://github.com/ayghri/i-have-adhd/blob/main/openai.yaml) (invocation policies), [`AGENTS.md`](https://github.com/ayghri/i-have-adhd/blob/main/AGENTS.md) (version mapping), [`package.json`](https://github.com/ayghri/i-have-adhd/blob/main/package.json) (dependencies), and [`hooks/hooks.json`](https://github.com/ayghri/i-have-adhd/blob/main/hooks/hooks.json) (always‑on behavior). These files collectively reveal how—and when—the skill executes, what it depends on, and how the user controls activation.