# Vet Before You Install: the ten checks (free sample)

A free PaperChaseWebb sample from Vet Before You Install. The ten checks we run before any third-party skill, plugin or repo touches a real machine, plus one prompt. Not a security audit.

## The ten checks

1. Identity: the repo matches the publisher's own site. No near-identical name confusion.
2. License: a license file exists, and you know whether it is share-alike.
3. Maintenance: recent commits and answered issues, read from the repo itself.
4. Scope: one sentence on what it does, which files, commands and hosts it needs.
5. Read-through: every file that runs has been read.
6. Dangerous tokens: network, exec, env and file write lines found and explained.
7. Pin: a specific commit, verified with git rev-parse HEAD.
8. Vendor: your own copy, not a remote one-line install.
9. Sandbox trial: disposable code, no network, no real secrets, a planted fake key that stays put.
10. Decision: a dated line: adopt, adopt with limits, reference only or reject.

Stars measure attention, not safety. Fail check 1, 5, 6 or 9 and the answer is reject or reference only.

## The prompt

```
Before I install [name or URL]: find the canonical repo from the publisher's own site,
read the LICENSE, last 10 commits and open issues, and list every file that executes.
Quote any line that touches the network, the shell, the environment or files outside its folder.
Do not install, clone into a real project or run anything.
```

## In the full pack

A read-first walkthrough, pin and vendor commands, a sandbox recipe for containers, Linux and macOS with a planted key test, 15 prompts, a drop-in vet-before-install SKILL.md, vetting card and adoption log templates, and special cases (in-process mods, share-alike licenses, reference implementations).

License: personal and commercial use. Contact: mgmt@paperchasewebb.com