How do you vet third-party AI agent skills before running them?

Treat every third-party skill as untrusted code. Read the files and lifecycle scripts yourself, and if you need to run one, use a sandbox or isolated container with tightly restricted filesystem, network, and credential access. A scanner can help, but it shouldn’t replace your own review and judgment.

Static scanning for prompt injection is a good starting point, but don’t stop at the top-level manifest. Check lifecycle hooks, dependencies, transitive permissions, and whether seemingly harmless steps can be chained together to read files or send data elsewhere. The execution environment should enforce the permissions, not just the scanner.

Prefer skills from official vendors or well-established projects when one is genuinely necessary. I’d still review what they do, but I wouldn’t install a skill just to handle a tiny task that the agent can already accomplish. Keep the number of installed tools as small as possible.

I’m especially wary of skills distributed through install scripts. I usually inspect the implementation and recreate the useful behavior myself instead of installing the package. If an agent does need to read or execute it, I run an automated scan first and keep it away from production credentials and sensitive files.