adopt-external

name	adopt-external
description	Use when reviewing an external repo or article to adopt practices into TAOM — security-vet first, map novel vs duplicative, port (never install), review, commit your changes.
allowed-tools	Read, Write, Edit, Bash, WebFetch, WebSearch

Adopt External Repo / Article

Evaluate an external repo or article and fold the genuinely-useful parts into TAOM — without importing bloat or risk. Thin entry point; the full procedure, principles, and accumulated gotchas live in docs/ai-includes/external-repo-adoption.md — read it first.

Trigger

User shares a repo/article "to see what we can adopt." One source at a time.

The cycle

Nine phases — read the full procedure in the doc before starting: Identify → Security-pass-FIRST → Map novel-vs-duplicative → Tiered recommendation → Implement (port, never install) → Adversarial review → Fix + RCA → Commit MINE only → Push.

See external-repo-adoption.md § The cycle for each phase in detail. (This skill stays thin and points to the doc rather than restating it — per external-skill-ports.md "Don't amplify a rule — point to it".)

Top gotchas

• Never install the external plugin — it's prompt-injection-by-design (SessionStart injects high-authority context) + context tax + conflicts with our curated setup. Port text instead.
• Calibrate, don't blind-port — a rule correct upstream can be wrong here (e.g. TAOM mandates fail-open hooks).
• Most of a general operator repo is irrelevant or duplicative for a C#/.NET Bannerlord mod. Be honest and critical.
• Right-size the fan-out — if the README makes the verdict obvious (clearly out-of-domain → skip), do a light inline pass; don't spin up a multi-agent workflow to confirm the obvious.
• Verify load-bearing security claims yourself before relaying a subagent's read — a subagent verdict is a hypothesis (evidence-over-claims.md A.4).
• Vet a foreign skill automatically during the security pass: python tools/audit_claude_config.py --root <repo> --external fires TAOM's SkillSpector-derived categories at full severity. Heavyweight option: NVIDIA SkillSpector run static-only in an isolated venv/Docker (never installed). It supplements, never replaces, the manual read.
• After porting config/hooks, run /security-scan on our own result.
• When DESCRIBING security patterns in the skill/docs you author, avoid embedding literal trigger strings (they can self-flag /security-scan) — describe the category or use audit-allow:.

Pair with

• /security-scan — runs at the end of the implement phase.
• /deep-review, /review-codex — for the adversarial-review phase on C# changes.
• external-skill-ports.md, evidence-over-claims.md, simplicity-criterion.md — the rules this cycle leans on.