Third-party agent skills and plugins are a supply chain: how to review them before installing
Agent skills, plugins and MCP servers extend coding and productivity agents with instructions and scripts. Installing one gives its author influence over what your agent reads, writes and runs. The risks we found reviewing community skills, a review checklist, and the sandboxing and policy controls we use.
