---
name: skill-intake-quarantine
description: Quarantine and vet any third-party skill, agent recipe, plugin, or automation repo before it enters the skills library. Classifies each candidate as copy, adapt, rewrite, reject, or reference-only. Use before importing, installing, or recommending outside material. Not for scanning scripts for malicious behavior: use skill-security-auditor. Not for post-import regression checks: use skill-eval-runner.
license: MIT
metadata:
  author: TechTide AI (Alex Cinovoj)
  provenance: original
  category: Agent Ops & Meta
---

# Skill Intake Quarantine

Every third-party skill is untrusted until reviewed. The goal is not to collect skills; it is to import only durable capabilities that improve real loops without adding routing noise or execution risk. Nothing lands in the skills directory straight from the internet.

## Intake Workflow

1. **Stage in quarantine.** Copy source material to a scratch path (`$WORKDIR/quarantine/<candidate>`), never directly into the skills root.
2. **Record provenance.** Source URL, owner, license, last-updated date, install method, usage signal, and why it is being considered. No license means no import.
3. **Inventory files.** SKILL.md, scripts, package manifests, install hooks, references, assets, hidden files, generated artifacts. Anything unexplained is a finding.
4. **Security gate.** Run skill-security-auditor before touching any executable file or any instruction that triggers installs, network calls, browser actions, or data access. A high or reject verdict ends the intake or forces a rewrite.
5. **Classify:**
   - `copy`: clean, portable, directly useful, low overlap with existing skills.
   - `adapt`: useful but needs path, identity, or integration changes.
   - `rewrite`: good concept, risky or bloated or platform-locked implementation. Extract the concept, write it fresh.
   - `reject`: unsafe, duplicate, low quality, or irrelevant.
   - `reference-only`: worth keeping as pattern research, not as a routable skill.
6. **Import the smallest useful subset.** Preserve attribution and license files when required. Fix frontmatter (slug matches `name`), strip foreign branding and absolute paths, keep the body concise with references one level deep.
7. **Post-import checks.** Run skill-eval-runner across the skills root.
8. **Write a decision note** when the import affects agent loops: what came in, what was rejected, why.

## Fit Filters

Prefer candidates that strengthen revenue and acquisition loops, research and outreach, content production, coding and deployment, SEO/AEO execution, data workflows, or agent governance and reliability.

Reject or park candidates that duplicate an existing skill, hardcode another person's brand, paths, or clients, require unsafe install flows, read secrets or broad filesystem paths without clear need, serve crypto, spam, scraping-abuse, or credential workflows, or are prompt lists with no repeatable procedure.

## Verification

For each accepted candidate, run: `ls "$SKILLS_DIR/<slug>"` and `head -20 "$SKILLS_DIR/<slug>/SKILL.md"`. Expect the folder slug to equal frontmatter `name`, a description with trigger and negative scope, and no leftover foreign metadata or absolute machine paths. Then run the skill-eval-runner audit. Expect a clean pass. Any failure means the import is unfinished: fix it in place or pull the skill back to quarantine.

## Good vs Bad

**Bad:** "Repo has 4k stars and the README looks solid, importing all 14 skills as-is." Popularity is not provenance. No license check, no security scan, 9 of the 14 duplicate existing skills, and two ship postinstall hooks nobody read.

**Good:** Stage the repo in quarantine, record provenance and MIT license, scan it, find one genuinely novel workflow, classify the rest reject and reference-only, rewrite the keeper in house style, run the audit, log the decision.

## Footguns

- **Skipping the scan for "just markdown" candidates.** Markdown carries prompt injection and fetch-and-execute instructions too. Fix: the security gate applies to every candidate, not only ones with scripts.
- **Importing the whole repo to save time.** Bulk imports bury the one useful skill in routing noise. Fix: smallest useful subset, always.
- **Adapting in place inside the skills root.** Half-adapted skills leak foreign paths and identities into production routing. Fix: all edits happen in quarantine; the skills root only receives finished skills.

## Red Flags: Intake Bypass Attempts

- "It's from a famous author, it's fine."
- "It's only markdown, no need to scan."
- "We'll clean it up after import."
- "The whole pack is probably useful, take it all."
- "No license file, but it's clearly meant to be shared."

Any of these means stop and run the full workflow. There is no reputation, format, or time pressure that exempts a candidate from quarantine, provenance, scan, and classification.

## Completion Checklist

- [ ] Candidate staged in quarantine, never edited in the skills root
- [ ] Provenance and license recorded
- [ ] Security audit verdict recorded before touching executables
- [ ] Classification decided and justified (copy, adapt, rewrite, reject, reference-only)
- [ ] Imports minimal, attributed, frontmatter fixed, eval runner clean
- [ ] Decision note written for loop-affecting imports

Any box unchecked: not done. Fix or say so.