Why Not Auto Install High Star Skills

Why Not Auto Install High Star Skills

High-star repositories are useful discovery signals, but they are not install decisions.

Stars Do Not Prove Fit

A repository can be popular because it is:

• a general tool, not an Agent Skill;
• useful for a different agent surface;
• old but historically famous;
• broad enough to attract attention but too vague for skill routing;
• impressive as a project but irrelevant to the user's current task.

Stars Do Not Prove Safety

High-star projects can still contain:

• prompt injection instructions;
• opaque install scripts;
• broad filesystem access;
• secret-reading behavior;
• destructive cleanup commands;
• stale dependencies.

Stars Do Not Prove Installability

The curator should check:

Check	Why
SKILL.md exists	Confirms it is an Agent Skill
Skill folder is isolated	Avoids copying an entire unrelated repository
Description is narrow	Prevents mis-invocation
License is clear	Reduces reuse ambiguity
Install path is known	Avoids partial installs
Safety scan is acceptable	Reduces prompt and supply-chain risk

Better Policy

Use stars to rank candidates for review. Do not use stars to skip review.

The best install candidate is usually the smallest skill that clearly solves the current workflow, has understandable files, and has no serious safety findings.