Treat an Agent Skill as executable workflow configuration, not a harmless document. Pin the public source, inspect every command and permission, install in a disposable project, run one reversible task, and record the result before wider use.
Before you install
Start by naming the exact task the Skill should improve and the output you expect. If the task is vague, you will not be able to tell whether the Skill helped.
Open the canonical source rather than copying an install command from an aggregator or social post. Record the owner, repository, path, commit, and license.
- Confirm the Skill identity and aliases.
- Read the full SKILL.md and any linked scripts.
- List network calls, credentials, file reads, file writes, and external actions.
- Identify a rollback or uninstall path.
Choose the target platform
A portable instruction file may work across multiple agents, but install locations, triggers, context loading, and supporting-file behavior differ.
Prefer explicit platform evidence. If compatibility is inferred, test the workflow as a hypothesis rather than treating it as supported.
Compatibility labels matter
Declared, inferred, and tested compatibility are different evidence levels. A generic Markdown file is not proof of native support.
Install in a narrow environment
Use a disposable repository with no production credentials. Grant the smallest possible file and network scope, then inspect the changes created by installation.
Do not run a command just because it appears in a polished README. Explain the command, package source, post-install behavior, and affected paths first.
- Use a temporary project or branch.
- Use test credentials with limited scope.
- Keep network access off unless the task requires it.
- Capture files added or modified during installation.
Run one reversible task
The first task should be representative enough to reveal value but safe enough to discard. Compare the result with a baseline that does not use the Skill.
Record success, failure, time, changed files, external actions, and any manual intervention. This turns a vague impression into reusable evidence.
A useful test record
Include the source commit, platform version, environment, input, acceptance criteria, result, duration, failure mode, and limitations.
Maintain, update, and retire
A Skill can become stale even when its repository remains active. Re-check source changes, install behavior, platform compatibility, and permissions before updating.
Retire a Skill when the source disappears, ownership becomes ambiguous, permissions expand unexpectedly, or the workflow no longer improves the target task.
Frequently asked questions
Can I install a Skill from any GitHub repository?
A public repository makes inspection possible, but does not establish safety, identity, or compatibility. Verify the canonical source, license, commands, and permissions first.
Does a high repository star count make a Skill safe?
No. Repository stars indicate attention to the repository and may cover many projects or Skills. They are not an audit of the specific source path.
Should installation be automated?
Inspection and repeatable testing can be automated. Execution of untrusted install commands should remain gated by an explicit human decision.
Skills referenced in this guide
jabrena/plinth
033-architecture-diagrams
Use when you need to generate Java project diagrams — including UML sequence diagrams, UML class diagrams, C4 model diagrams, UML state machine diagrams, UML Deployment Diagrams, ER (Entity Relationship) diagrams, and bounded-context diagrams — through a modular, step-based interactive process that adapts to your specific visualization needs. This should trigger for requests such as Generate UML diagram; Create sequence diagram; Create class diagram; Create state machine diagram; Create deployme
minhnv0807/ai-business-skills
04-script-video-global
Use when the user needs a spoken script for short-form video — TikTok, Reels, or YouTube Shorts — with a 3-part hook, second-by-second beats, two A/B variants, shoot notes, and a viral score. Switches between product mode and personal brand mode from the context file. Trigger on 'video script', 'TikTok script', 'Reels script', 'Shorts script', 'what should I say in the video', 'write me a hook for a video'. Also use when the user has a video idea and knows only the topic. Not for — cut and edit
minhnv0807/ai-business-skills
05-ad-copy-global
Use when the user needs PAID ad copy for Meta, Google, or TikTok — six variants across TOFU, MOFU, and BOFU using AIDA, PAS, and BAB, respecting each platform character limit and ad policy, with a dropshipping mode. Trigger on 'ad copy', 'write Facebook ads', 'TikTok ad copy', 'Google RSA headlines', 'primary text for this ad', 'my ad copy is not converting'. Also use when the user has a product page and asks what to run as an ad. Not for — organic social captions, see `37-social-caption-global`
minhnv0807/ai-business-skills
17-pricing-strategy-global
Use when a price has to be set or changed — value-based pricing, anchoring, charm pricing, decoy tiers, good-better-best packaging, discount policy, and margin math, with currency psychology for US, EU, SEA, and LATAM plus dropshipping markup and BE-ROAS. Trigger on 'pricing strategy', 'how much should I charge', 'should I raise prices', 'price tiers', 'customers say it is too expensive', 'dropshipping markup'. Also use when the product is not selling and the user suspects price is the reason. N