Use this list on the page you are about to act on. It applies to a skill prompt, a DeepSeek Harness plugin, and a model you are about to call from production. If you cannot tick an item, you are not ready to install. You are ready to read one more page. The longer versions are when not to install a skill, the plugin guide, and how to read a model listing.

The job

  • You can say what file, message, or decision this install is supposed to produce.
  • That sentence matches the examples on the page, not just the category name.
  • You know what "wrong" looks like, so you can stop.

A page you opened because it was at the top of a sorted list fails the first tick until you write the sentence. Sort order is explained in how ranking works. It is not a review.

The publisher

  • You opened the upstream link and it loads.
  • The publisher on the card matches the publisher on that page.
  • You can name the license, or you have decided you only need to read, not to ship the code.

If the upstream link 404s, stop. Tell us on the contact form with the card URL. Do not replace it with a search-engine result that happens to share the name.

The permissions

  • You know whether it wants a key, a local folder, a browser, a chat export, or network access.
  • The key, if any, is a limited key you can revoke this afternoon.
  • You are not pasting a production secret into the chat to "see if it works."

Skills under Pay Skill and plugins under model inference fail this section more often than a documentation skill does. That is normal. Budget extra time.

The blast radius

  • The first run is on a branch, a copy, or a sample file.
  • You know how to remove the skill from the agent's settings, not only from the chat. The install guide lists both layers.
  • For a plugin, you found the uninstall command in the README before you ran the install command.
  • For a model, you know whether the prompt leaves your network.

The overlap

  • You do not already have a skill or plugin doing the same job.
  • You are not installing a skill to fake a tool the model does not have.
  • You are not installing a plugin because a model comparison was inconclusive. Comparisons are settled with a prompt, as described in deciding after a comparison.

After the first run

  • The output matches the format the page promised, on an input whose answer you know.
  • Nothing changed outside the files you named.
  • You can explain the result without quoting the model's confidence.

If those three fail, remove it today. A second install will not diagnose the first. The first week plan is built around that rule: one addition at a time, and permission to end the week with nothing new except a pinned model name.

Print the list or keep it beside the directory. The cards are numerous on purpose. The checks are short on purpose. The point of the directory is that you can leave most pages uninstalled.

Filling the list in on a real page

Here is the list applied to a plugin rather than a skill, so the ticks are not abstract. You have the better sidebar sort of card open: a client plugin whose pitch is that you can see files and git status without leaving the chat. The job sentence is "peek at git status while I talk to the agent." That matches a client category, which you confirm by reading how to read plugin categories. The upstream GitHub page loads and the license is one you can name. The permissions include reading the working tree and running git. You decide a limited risk is acceptable because you already run git in that folder, and you still refuse any extra command the README describes as "run arbitrary tasks." The first run is a spare project. You have the uninstall section of the README open in the next tab before you install. You do not already have another sidebar. After install, git status in the widget matches git status in a terminal, and the plugin did not commit. Those are the ticks. If the widget offers to push to the remote on a single click, the blast-radius tick fails and you uninstall before the click becomes a habit.

Apply the same list to a model and the nouns change. Job: "summarize this one package, which fits in 80,000 tokens." Window: the listing claims more than that, so the context tick passes. License: your policy allows this vendor. Hosting: the prompt leaves your network, and the package is internal, so the hosting tick fails. You switch to an open listing you can serve, or you strip the package to the files you are allowed to send. The comparison table will not notice that policy. You have to.

What a failed tick is worth

A failed tick is not a research project. It is a stop. The directory will still offer a neighboring card that fails a different tick. Running the checklist on five cards and installing none is a successful visit. Write down which tick failed so you do not reopen the same card tomorrow and negotiate with yourself. "No uninstall command" does not become acceptable because the stars are high. "Needs a production key" does not become acceptable because the demo looked fast.

If every card in a category fails the same tick, the category may be the wrong tool for your constraint. A team that cannot send code off-machine will fail the hosting tick on every closed model. That is a useful result. Go to open source and start the list over, rather than weakening the tick. The first week assumes you would rather finish empty-handed than finish with an install you cannot explain. Tape the failed tick to the top of your note for that page. The next time the same card looks tempting, the tick is the whole reread. You do not need a new framework for this. You need the same ten checks on a page you are slightly too excited about, because excitement is what skips the uninstall step and the license step. Those two are the ones people skip when the demo is short. If the demo was a video on the upstream page rather than a run in your own folder, you have not started the checklist at all. Watch it if you want, then return to the permissions tick and the blast-radius tick before you copy an install command. A video is not a trial. Count the ticks you skipped while the video played, and do those ticks before the install command is on the clipboard. The clipboard is the moment the checklist either happened or did not. If the command is already copied, put it back, and run the ticks you skipped. Installing from a copied command is how the uninstall step gets lost.