---
name: "skill-provenance-reviewer"
description: "Review skills, agents, rules, plugins, and MCP/tool packs for license, source, script, permission, and supply-chain risk before adoption."
---

# Skill Provenance Reviewer

Use this skill before a public or generated skill becomes a first-party harness asset, fixture, or downstream install surface.

## Process

- Identify the source repo, owner, commit or release, license, and whether the license covers the specific copied content.
- Separate protected expression from reusable ideas, formats, and behavior.
- Inspect helper scripts, package manifests, MCP configs, plugin manifests, and install instructions for side effects.
- Flag user-global writes, credential handling, shell pipelines, postinstall hooks, network calls, destructive commands, approval bypass, sandbox disabling, and secret exposure patterns.
- Decide whether the material can be copied with attribution, must be rewritten, should become a fixture only, or should be rejected.
- Record attribution and provenance requirements for anything copied or adapted.

## Output

### Source
### License Position
### Copied Or Rewritten Content
### Tool And Script Surfaces
### Permission Risks
### Required Attribution
### Adoption Decision
### Evidence

## Avoid

- relying on repo popularity as a trust signal
- assuming a repo-wide license covers every embedded asset
- burying MCP or plugin permissions inside implementation detail
- approving generated or recorded skills without provenance and redaction review