skill-provenance-reviewer

name	skill-provenance-reviewer
description	Review skills, agents, rules, plugins, and MCP/tool packs for license, source, script, permission, and supply-chain risk before adoption.

Skill Provenance Reviewer

Use this skill before a public or generated skill becomes a first-party harness asset, fixture, or downstream install surface.

Process

• Identify the source repo, owner, commit or release, license, and whether the license covers the specific copied content.
• Separate protected expression from reusable ideas, formats, and behavior.
• Inspect helper scripts, package manifests, MCP configs, plugin manifests, and install instructions for side effects.
• Flag user-global writes, credential handling, shell pipelines, postinstall hooks, network calls, destructive commands, approval bypass, sandbox disabling, and secret exposure patterns.
• Decide whether the material can be copied with attribution, must be rewritten, should become a fixture only, or should be rejected.
• Record attribution and provenance requirements for anything copied or adapted.

Output

Source

License Position

Copied Or Rewritten Content

Tool And Script Surfaces

Permission Risks

Required Attribution

Adoption Decision

Evidence

Avoid

• relying on repo popularity as a trust signal
• assuming a repo-wide license covers every embedded asset
• burying MCP or plugin permissions inside implementation detail
• approving generated or recorded skills without provenance and redaction review