Instructions and prompt injection
Look for instructions that attempt to override an agent, conceal their purpose, or change the intended task.
Pre-install skill review
A SKILL.md file tells an AI agent how to behave. Validate its instructions and the files around it before you give that skill access to your environment.
Validate a skill for freeLook for instructions that attempt to override an agent, conceal their purpose, or change the intended task.
Review shell execution, downloads, dynamic code, and setup instructions before allowing them to run.
Identify requests for credentials, environment variables, filesystem access, network access, and external services.
Check scripts, workflows, dependencies, registries, and related files rather than trusting a SKILL.md in isolation.