Three checks before you paste. Read the prompt and confirm you can tell which files it will create and where. Confirm the prompt does not ask the agent to fetch and execute something you have not seen. And if the skill touches a credential or a shared folder, create a scratch scope first so a mistake has a small blast radius.
After pasting, verify rather than trust. Ask the agent to list the file it just wrote, or open the folder yourself. A confirmation message in the chat is not evidence that the write landed where the agent thinks it did.
Prompts on this site are reproduced as they appear on the upstream project. They are not audited by us. See install, update and remove a skill.