# Vet Before You Install: ten checks, a sandbox recipe and a skill for third-party agent code

> A Markdown pack for deciding whether a skill, plugin, mod, MCP server or repo is safe to let into your agent setup: read it first, pin and vendor it, trial it in a sandbox with a planted fake key, then write the decision down.

- URL: https://paperchasewebb.ai/bots/marketplace/items/vet-before-you-install/
- Type: Prompt pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Cursor (named in the listing); Plain .md
- Price: $39 USD
- Difficulty: Intermediate
- Setup time: 15 min
- Time to result: First vetting card in one sitting
- Format: Markdown (.md) file, vet-before-you-install.md
- Version: 1.0, updated 2026-10-26
- License: Personal and commercial use inside your own work. Do not resell or republish this pack.

## What you end up with

Nothing third-party runs on your machine until it has been read, pinned, trialed on disposable code and given a dated decision.

## What you get

- Why star counts are not vetting
- The ten checks
- A read-first walkthrough with a dangerous token scan
- Pin and vendor commands
- A sandbox recipe for containers, Linux and macOS with a planted key test
- 15 prompts
- A drop-in vet-before-install SKILL.md
- Vetting card, adoption log and reject note templates
- Special cases: in-process mods, share-alike licenses, reference implementations
- A credited source list

## Who it is for

People who see "install these 40 skills" posts and want a routine that keeps unknown code away from real projects and real secrets.

## Tools needed

- Claude Code: reads candidates and runs the vet skill
- Codex: reads candidates and runs the vet skill
- git: pins and verifies commits
- Docker or prlimit: sandbox trial
- You need: An AI coding agent with shell access
- You need: git
- You need: macOS or Linux

Cost to run: Free. Docker is optional.

## Sample prompt: Read before anything runs (Claude Code, Codex)

```
In ~/vetting/REPO, list every file that executes or that a skill instructs an agent to run. Explain each in plain words.
Quote any line that touches the network, the shell, the environment or files outside its folder. Do not run anything.
```

Validators and helper scripts are where surprises hide.

## Free preview of vet-before-you-install.md

````markdown
# Vet Before You Install

A PaperChaseWebb pack, version 1.0. A vetting routine, prompts, a sandbox recipe and an agent skill for deciding whether a skill, plugin, mod, MCP server or repository is safe to let into your agent setup. Written for Claude Code, Codex, Cursor and Grok Bot style agents on macOS or Linux.

This pack is not a security audit and does not certify anything as safe. It is the routine we use before any third-party code touches a real machine, rebuilt in our own words from public posts, public repositories and our own vetting notes. Sources are credited in `10-sources.md`.

## Files

| File | What it is for |
|---|---|
| 01-why-stars-are-not-vetting.md | What a star count measures, what it does not, and the question to ask instead |
| 02-the-ten-checks.md | The ten checks every candidate passes before it runs anywhere you care about |
| 03-read-it-first.md | How to have an agent read the whole skill or repo, line by line, without running it |
| 04-pin-and-vendor.md | Pinning a commit, verifying it, and keeping your own copy instead of a one-line remote install |
| 05-sandbox-trial.md | A disposable trial recipe: no network, read-only host, allowlisted environment, a planted fake key |
| 06-prompts.md | 15 prompts, from intake to the adopt or reject decision |
| 07-vet-skill.md | A drop-in SKILL.md that makes an agent refuse to install anything it has not vetted |
| 08-templates.md | VETTING-CARD.md, ADOPTION-LOG.md and a reject note |
| 09-special-cases.md | In-process mods, reference implementations, share-alike licenses, near-identical names |
| 10-sources.md | Every source we learned from, linked and credited |
````

## Worth knowing

- This is a routine, not a security audit or a certification.
- A sandbox lowers risk; it does not remove it.

## Questions

**Do I need Docker?** No. The pack includes an env -i and prlimit recipe for Linux and a separate user or VM approach for macOS.

**Does it recommend specific skills?** No. Public repos are named only as examples of things worth vetting, with their licenses as stated by each repo.

## How to buy

$39 one time at https://paperchasewebb.ai/bots/marketplace/items/vet-before-you-install/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com