Treat an Agent Skill as executable workflow configuration, not a harmless document. Pin the public source, inspect every command and permission, install in a disposable project, run one reversible task, and record the result before wider use.
Before you install
Start by naming the exact task the Skill should improve and the output you expect. If the task is vague, you will not be able to tell whether the Skill helped.
Open the canonical source rather than copying an install command from an aggregator or social post. Record the owner, repository, path, commit, and license.
- Confirm the Skill identity and aliases.
- Read the full SKILL.md and any linked scripts.
- List network calls, credentials, file reads, file writes, and external actions.
- Identify a rollback or uninstall path.
Choose the target platform
A portable instruction file may work across multiple agents, but install locations, triggers, context loading, and supporting-file behavior differ.
Prefer explicit platform evidence. If compatibility is inferred, test the workflow as a hypothesis rather than treating it as supported.
Compatibility labels matter
Declared, inferred, and tested compatibility are different evidence levels. A generic Markdown file is not proof of native support.
Install in a narrow environment
Use a disposable repository with no production credentials. Grant the smallest possible file and network scope, then inspect the changes created by installation.
Do not run a command just because it appears in a polished README. Explain the command, package source, post-install behavior, and affected paths first.
- Use a temporary project or branch.
- Use test credentials with limited scope.
- Keep network access off unless the task requires it.
- Capture files added or modified during installation.
Run one reversible task
The first task should be representative enough to reveal value but safe enough to discard. Compare the result with a baseline that does not use the Skill.
Record success, failure, time, changed files, external actions, and any manual intervention. This turns a vague impression into reusable evidence.
A useful test record
Include the source commit, platform version, environment, input, acceptance criteria, result, duration, failure mode, and limitations.
Maintain, update, and retire
A Skill can become stale even when its repository remains active. Re-check source changes, install behavior, platform compatibility, and permissions before updating.
Retire a Skill when the source disappears, ownership becomes ambiguous, permissions expand unexpectedly, or the workflow no longer improves the target task.
Frequently asked questions
Can I install a Skill from any GitHub repository?
A public repository makes inspection possible, but does not establish safety, identity, or compatibility. Verify the canonical source, license, commands, and permissions first.
Does a high repository star count make a Skill safe?
No. Repository stars indicate attention to the repository and may cover many projects or Skills. They are not an audit of the specific source path.
Should installation be automated?
Inspection and repeatable testing can be automated. Execution of untrusted install commands should remain gated by an explicit human decision.
Skills referenced in this guide
jabrena/plinth
033-architecture-diagrams
Use when you need to generate Java project diagrams — including UML sequence diagrams, UML class diagrams, C4 model diagrams, UML state machine diagrams, UML Deployment Diagrams, ER (Entity Relationship) diagrams, and bounded-context diagrams — through a modular, step-based interactive process that adapts to your specific visualization needs. This should trigger for requests such as Generate UML diagram; Create sequence diagram; Create class diagram; Create state machine diagram; Create deployme
minhnv0807/ai-business-skills
05-ad-copy-global
Use when the user needs PAID ad copy for Meta, Google, or TikTok — six variants across TOFU, MOFU, and BOFU using AIDA, PAS, and BAB, respecting each platform character limit and ad policy, with a dropshipping mode. Trigger on 'ad copy', 'write Facebook ads', 'TikTok ad copy', 'Google RSA headlines', 'primary text for this ad', 'my ad copy is not converting'. Also use when the user has a product page and asks what to run as an ad. Not for — organic social captions, see `37-social-caption-global`
minhnv0807/ai-business-skills
18-referral-program-global
Use when customers should bring other customers — one-way versus two-way incentives, reward structure and economics, trigger moments, referral messaging, tracking and attribution, fraud controls, and anti-spam compliance by region: TCPA for US, GDPR for EU, PDPA for SEA, LGPD for LATAM. Trigger on 'referral program', 'refer a friend', 'word of mouth', 'viral loop', 'how do I get customers to bring friends', 'affiliate rewards'. Also use when the user has happy customers and no system to use them
minhnv0807/ai-business-skills
20-client-intake-brief-global
Use when an agency or freelancer takes on a NEW client and needs everything up front — an 11-section intake covering business overview, audience, current marketing, goals, budget, timeline, brand assets, approval process, and success criteria, written for the client to fill in and return. Trigger on 'client intake', 'agency brief', 'onboard a new client', 'discovery call template', 'what should I ask a new client', 'kickoff questionnaire'. Also use when the user just signed someone and does not