Vetfirst: Read every file before a skill gets installed

An agent skill, plugin or MCP server runs with your agent's permissions, but most get installed on the strength of a star count or a marketplace badge. The risky part is rarely in the main file: it sits in a setup command, a hook, a hidden config or a reference file nobody opened. Vetfirst treats every outside skill like code from a stranger and reads it before anything is installed.

What it does

• Provenance records repo, author handle and marketplace page, and checks repo age, activity, security issues and typosquat names.
• Licence decides what may be copied: with attribution, ideas only, or not at all.
• Pin and read clones read-only into a scratch folder, records the commit, and reads every file including hidden configs.
• Risk scan greps for downloads, installs, load-time shell, hooks, MCP configs, eval, base64, sudo, credential reads and remote fetches, then reads each hit in context.
• Omit, not patch keeps only trusted files and drops risky scripts and configs instead of editing them.
• Registry logs source, commit, licence, kept and omitted files, and a scan summary.

How it works

1. Check provenance and licence.
2. Clone and pin, never running the repo's installer or a curl ... | sh line.
3. Inventory and scan every file; binary or minified files with no source are rejected.
4. Judge each hit benign or risky. When unsure, it is risky.
5. Show a verdict table (install, install with omissions, reject) and wait for your yes.
6. Record and re-scan on every update against the pinned commit.

Frameworks & tools

git, find, wc and grep with a ready scan pattern. Works on any skill, plugin, agent config, prompt pack or MCP server.

Why this beats prompting it yourself

A quick prompt usually reads SKILL.md and stops. This skill reads every file, flags load-time execution as the worst class, never opens the repo in an agent session that would auto-load it, and only counts your yes, not the agent's confidence.

Use cases

• Before any install from a marketplace, repo, gist or chat message.
• MCP server review of tools, write or delete actions, network hosts and token scopes.
• Batch vetting with one table and one registry section.

Known limitations

Not for auditing your own app code or package dependencies. It does not fix risky third-party scripts; it drops them or rewrites the idea. Nothing is installed automatically.