Vet Before You Install: the ten checks (free sample)

Before I install [name or URL]: find the canonical repo from the publisher's own site, read the LICENSE, recent commits and issues, and list every file that executes.
Do not install or run anything.

Stars measure attention, not safety.

# Vet Before You Install: the ten checks (free sample)

A free PaperChaseWebb sample from Vet Before You Install. The ten checks we run before any third-party skill, plugin or repo touches a real machine, plus one prompt. Not a security audit.

## The ten checks

1. Identity: the repo matches the publisher's own site. No near-identical name confusion.
2. License: a license file exists, and you know whether it is share-alike.
3. Maintenance: recent commits and answered issues, read from the repo itself.
4. Scope: one sentence on what it does, which files, commands and hosts it needs.
5. Read-through: every file that runs has been read.
6. Dangerous tokens: network, exec, env and file write lines found and explained.
7. Pin: a specific commit, verified with git rev-parse HEAD.
8. Vendor: your own copy, not a remote one-line install.
9. Sandbox trial: disposable code, no network, no real secrets, a planted fake key that stays put.
10. Decision: a dated line: adopt, adopt with limits, reference only or reject.