Security Considerations for Installing Third-Party Skills: A Complete Review Checklist

Before installing any third-party skill, verify explicit activation flags, check for always‑on opt‑ins, audit dependencies, and validate manifest consistency to prevent unauthorized code execution and supply‑chain attacks.

Third‑party skills extend AI coding assistants with custom behaviors, but they also introduce potential security risks if not properly vetted. The ayghri/i-have-adhd repository demonstrates a security‑conscious skill architecture that you should use as a benchmark when evaluating any community‑contributed plugin. This guide walks through seven critical security considerations based on the actual implementation in this reference repository.

Verify Explicit Activation Requirements

A secure skill should never execute code automatically upon installation. In ayghri/i-have-adhd, this protection is enforced through multiple layers.

Disable Model Invocation Flag

The core skill definition in skills/i-have-adhd/SKILL.md explicitly sets:

disable-model-invocation: true

This line (at line 4) ensures the skill remains dormant until the user deliberately triggers it with the /i-have-adhd command. Always confirm this flag exists in any skill's SKILL.md before installing.

Policy‑Driven Implicit Invocation Blocking

For OpenAI‑based runtimes, the repository includes skills/i-have-adhd/agents/openai.yaml with this configuration:

allow_implicit_invocation: false

Lines 6‑8 of this file prevent the Codex model from auto‑triggering the skill based on prompt content. Cross‑reference any skill's YAML policy files to confirm implicit calls are disallowed.

Check the Always‑On Opt‑In Mechanism

Persistent activation should require deliberate user action, not default behavior.

In ayghri/i-have-adhd, always‑on mode is controlled by hooks/hooks.json. The skill only enters always‑on state when the user manually creates a flag file at ~/.claude/.i-have-adhd-always. This design pattern ensures:

• No silent activation after install
• The user consciously decides whether rules inject into every session
• The hook logic is isolated from core skill files

Before installing any skill, verify its documentation for how persistent activation works—default always‑on behavior is a red flag.

Validate Manifest Consistency

Runtime‑specific manifests prevent tampering by binding version metadata to exact code states. The ayghri/i-have-adhd repository maintains these manifests across multiple directories:

Runtime	Manifest Location
Claude	.claude-plugin/
Codex	.codex-plugin/
OpenCode	.opencode/plugins/

According to AGENTS.md (lines 18‑26), these manifests list the skill version and metadata. Before installation, compare the version you're about to install against the repository's version map. A mismatch suggests potential tampering or an outdated copy.

Audit for Hidden Secrets and Credentials

Credential leakage is a common supply‑chain risk. The ayghri/i-have-adhd repository contains zero .env files and no hard‑coded API keys. Required credentials must be supplied by the user after installation.

When reviewing any third‑party skill:

# Search for common secret patterns

grep -r -i "api_key\|secret\|password\|token" --include="*.py" --include="*.js" --include="*.yaml" .

Any embedded credentials should disqualify a skill from immediate installation pending author clarification.

Run Dependency Vulnerability Scans

Third‑party libraries can introduce transitive vulnerabilities. For Node.js‑based skills like ayghri/i-have-adhd, dependencies are declared in package.json.

Always execute a dependency audit before installing:

# Clone and audit

git clone https://github.com/ayghri/i-have-adhd
cd i-have-adhd
npm audit

Review any reported vulnerabilities and ensure the skill pins specific versions rather than using loose version ranges that could pull compromised updates.

Inspect Installation Script Safety

The installation process itself can be an attack vector. INSTALL.md in ayghri/i-have-adhd shows read‑only installation patterns:

# Example: Safe installation via curl fetch

curl -fsSL https://raw.githubusercontent.com/ayghri/i-have-adhd/main/install.sh -o install.sh

# Review before executing

cat install.sh
bash install.sh

Dangerous patterns to avoid include:

• Piped curl executions (curl ... | bash) that prevent inspection
• Remote script execution without local verification
• Privilege escalation requests without clear justification

Practical Pre‑Installation Verification Workflow

Apply this checklist to any third‑party skill before running installation commands like agy plugin install, claude plugin add, or codex plugin install:

# 1. Clone and inspect source

git clone <skill-repository-url>
cd <skill-directory>

# 2. Verify explicit activation flag

grep -i "disable-model-invocation" skills/*/SKILL.md

# 3. Check Codex policy (if applicable)

cat skills/*/agents/openai.yaml | grep allow_implicit_invocation

# 4. Audit dependencies

npm audit

# 5. Search for embedded secrets

find . -name "*.env" -o -name "*.secret" 2>/dev/null
grep -r "sk-[a-zA-Z0-9]" . --include="*.py" --include="*.js" 2>/dev/null

# 6. Compare manifest version with AGENTS.md

cat AGENTS.md | grep -A2 <skill-name>

Summary

• Explicit activation only — Look for disable-model-invocation: true in SKILL.md and allow_implicit_invocation: false in runtime YAML files
• Always‑on requires opt‑in — Confirm persistent activation needs manual flag file creation, not default behavior
• Manifest versioning — Verify version consistency across .claude-plugin/, .codex-plugin/, and other runtime manifests against AGENTS.md
• Zero embedded credentials — Reject skills with .env files or hard‑coded secrets in source
• Dependency audit — Run npm audit or equivalent before installing any skill with external packages
• Read‑only install scripts — Avoid piped curl executions; fetch, inspect, then run

Frequently Asked Questions

What is the most critical security check before installing a third‑party skill?

Verifying explicit activation requirements is the highest‑priority check. Confirm that disable-model-invocation: true appears in the skill's SKILL.md and that runtime policies like allow_implicit_invocation: false prevent automatic execution. This single check eliminates the risk of malicious code running immediately upon installation.

How can I tell if a skill will activate automatically in every session?

Check the skill's documentation and hook configuration for always‑on opt‑in patterns. Secure skills like ayghri/i-have-adhd require users to manually create a flag file (e.g., ~/.claude/.i-have-adhd-always) rather than enabling persistent activation by default. Review hooks/hooks.json and installation docs for the specific mechanism.

Should I trust a skill that uses curl ... | bash for installation?

No—this pattern prevents you from inspecting the script before execution. The ayghri/i-have-adhd repository demonstrates safer alternatives in INSTALL.md: fetch scripts with curl -o, review the contents locally, then execute. Any skill insisting on piped execution warrants additional scrutiny or rejection.

What files should I prioritize when auditing a skill's security?

Focus on five key files in this order: SKILL.md (activation flags), runtime YAML configs like openai.yaml (invocation policies), AGENTS.md (version mapping), package.json (dependencies), and hooks/hooks.json (always‑on behavior). These files collectively reveal how—and when—the skill executes, what it depends on, and how the user controls activation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}