# Vet Before You Install: the ten checks (free sample)

> The ten checks to run before any third-party skill, plugin or repo touches a real machine, plus one read-first prompt.

- URL: https://paperchasewebb.ai/bots/marketplace/items/vet-before-you-install-free-sample/
- Type: Prompt pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex (named in the listing); Plain .md
- Price: Free USD
- Difficulty: Beginner
- Setup time: 5 min
- Time to result: Five minutes per candidate
- Format: Markdown (.md) file, vet-before-you-install-free-sample.md
- Version: 1.0, updated 2026-10-26
- License: Personal and commercial use.

## What you end up with

Your agent reads and scopes a candidate before anything is installed.

## What you get

- The ten checks
- A read-first prompt

## Who it is for

Anyone about to install a skill or plugin from a list they saw online.

## Tools needed

- Claude Code or Codex: reads the candidate
- You need: An AI coding agent

Cost to run: Free.

## Sample prompt: Before I install (Claude Code, Codex)

```
Before I install [name or URL]: find the canonical repo from the publisher's own site, read the LICENSE, recent commits and issues, and list every file that executes.
Do not install or run anything.
```

Stars measure attention, not safety.

## Free preview of vet-before-you-install-free-sample.md

````markdown
# Vet Before You Install: the ten checks (free sample)

A free PaperChaseWebb sample from Vet Before You Install. The ten checks we run before any third-party skill, plugin or repo touches a real machine, plus one prompt. Not a security audit.

## The ten checks

1. Identity: the repo matches the publisher's own site. No near-identical name confusion.
2. License: a license file exists, and you know whether it is share-alike.
3. Maintenance: recent commits and answered issues, read from the repo itself.
4. Scope: one sentence on what it does, which files, commands and hosts it needs.
5. Read-through: every file that runs has been read.
6. Dangerous tokens: network, exec, env and file write lines found and explained.
7. Pin: a specific commit, verified with git rev-parse HEAD.
8. Vendor: your own copy, not a remote one-line install.
9. Sandbox trial: disposable code, no network, no real secrets, a planted fake key that stays put.
10. Decision: a dated line: adopt, adopt with limits, reference only or reject.
````

## Worth knowing

- Not a security audit.

## Questions

**What is in the full pack?** Pin and vendor commands, a sandbox recipe with a planted key test, 15 prompts, a vet skill, templates and special cases.

## How to get it

Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/vet-before-you-install-free-sample/, no signup.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com