External Agent Pack Audit

Use this skill before importing or adapting a third-party agent, skill, command, hook, plugin, or marketplace pack.

Do not install or execute unknown packs just to inspect them. Read repository metadata and files first.

Audit Scope

Check:

• license and attribution requirements;
• install scripts and hooks;
• commands that execute code;
• network access and API keys;
• generated files and caches;
• secret handling;
• compatibility with Codex skill format;
• overlap with existing Engineering Bible skills;
• immutable source revision, skill-tree and license digests;
• transitive skill/tool dependencies and existing native providers;
• whether a thin host/policy adapter can preserve the author's complete tree.

Inspect actual startup and install code for instruction takeover: rewriting AGENTS.md or CLAUDE.md, replacing the primary rules source, mirroring skills into multiple discovered roots, enabling hooks, or adding global output styles. Check imports too: loading a library can read .env, create state, enable telemetry, or initialize clients before any explicit task is run.

Verify provider selection, automatic fallback, retry/loop bounds and export destinations. A router's catalog or requested model name does not establish the actual recipient. Do not import a second workflow/memory system just to reuse one narrow capability.

For SSH transports, require verified host-key checking against the intended host; accepting any host key fails the trust check. Command permissions and SFTP path restrictions protect different surfaces. Reject broad command access or unrestricted tunnels disguised as a read-only file tool.

For device, batch and proxy tools, inspect nested operations as well as exposed names. A tool-name allowlist does not constrain arbitrary commands inside an allowed batch. Verify advisory fixes and telemetry opt-outs for the exact installed version; run synthetic rejection tests before host activation.

Decision Options

Choose one:

• managed upstream install: compatible, reviewed and requested author trees, retaining origin, exact revision, license and separate update/rollback state;
• native provider reuse: retain native ownership and update through its manager;
• thin adaptation: keep author instructions intact and isolate host invocation or owner-policy integration in a separately maintained adapter;
• explicit fork: rewrite only when the owner deliberately accepts maintaining a separate workflow; record derivation and do not claim automatic author updates;
• reference only: document the idea without installing;
• reject: unsafe, unclear license, or too much runtime coupling.

Evidence

Use current sources:

• upstream README;
• license file;
• plugin metadata;
• install scripts;
• relevant source files;
• local validation output if cloned for inspection.

For catalog-managed installs use be skills plan before the explicit ensure selection. A read-only check can report author changes; only a reviewed catalog revision may be applied by update. Review added hooks, scripts, licenses and dependencies before changing that pin. Unknown or changed local trees remain conflicts. Skill rollback does not undo package-manager tool changes, credentials or native plugin setup; report actual partial effects. Installation never proves that a runtime exposes or can invoke the skill.

Output

External pack audit:
- Source:
- License:
- Runtime/hooks:
- Secrets/network:
- Overlap:
- Decision:
- Adaptation plan:
- Validation: