Vet a third-party skill, your AI Code plugin, MCP server, editor extension, GitHub Action or small open-source tool before it is installed: who really publishes it, what it can do without being asked, what it can reach, how it is kept up, and whether it earns a place.
1 in the Claude listing