The directory will let you open any skill page. That is not advice to install it. Several whole categories exist for jobs that are easy to describe and risky to hand to an agent. This guide is the stop list. If a card matches one of the cases below, leave it, even when the download count is high.

It wants a secret in the chat

A skill that cannot run without an API key, a cloud token, or a password is asking you to put that secret where the agent can read it and where the chat log may store it. Sometimes that is a deliberate trade, for example a document API you already pay for and already trust. Often it is not. The office skills that talk to a cloud document suite, and anything under Pay Skill, should be read as billing and credential questions first and as convenience second.

Do not install if:

  • The prompt says to paste the key into the conversation instead of using an environment variable or the agent's own secret store.
  • You cannot name the vendor that will receive the key.
  • The key is a production key rather than a throwaway key with a tiny quota.
  • The skill also asks for permission to read arbitrary local files. A key plus broad file access is how a sloppy prompt becomes a data leak.

Create a separate key with the minimum scope, try one call, and revoke the key if the output is wrong. Do not "just try" the key you use for payroll or for your main cloud account.

It wants someone else's private text

Data Analysis includes tools that read chat exports, and Life Service includes tools that read household budgets. The analysis can be legitimate when the text is yours and stays on your machine. It is the wrong install when the export includes other people's messages they did not agree to analyze, or when the prompt sends the export to a model API you have not reviewed.

A local-only claim on the card is a claim, not a measurement. Read the prompt. If it tells the agent to upload, summarize to a third-party endpoint, or "use the best available model," assume the text leaves the machine until you prove otherwise.

The license and the card disagree

The sidebar shows a license when the listing has one. The upstream page is the one that counts. If the card says MIT and the repository says a non-commercial license, believe the repository. If there is no license at all, you do not have permission to treat the prompt as yours to redistribute, and you should assume you also do not have a warranty. Professional listings such as legal retrieval add another layer: a retrieved statute can be out of date, and a confident paragraph is not legal advice. Do not install a legal skill to answer a question you would be ashamed to show a lawyer.

The prompt fights the agent you already run

Refuse prompts that say to ignore previous instructions, to hide the commands they run, to continue after a failed check, or to present invented sources as real. Those lines are not "more autonomous." They remove the only signals you have when the answer is wrong. Also refuse a prompt that tells the agent it is the user's employer, lawyer, or doctor. Role-play does not create a duty of care, and it does create confident nonsense.

If you already keep a short project rules file, read the skill against it. Two instructions that both claim to be the highest priority will be resolved by whichever the model sees last. That is not a configuration you want to debug on a deadline. The checklist is the same idea in a form you can tick.

You are trying to fix a model or a plugin problem

A skill does not make a weak model careful, and it does not install a DeepSeek Harness plugin. If the agent forgets the middle of a long repository, you want a longer context window or a smaller task, which is a model decision, explained in how to read a model listing. If you want a sidebar, a memory store, or a vision tool inside DeepSeek Harness, you want the plugin directory, not another skill prompt.

Installing a skill to paper over a missing tool produces a prompt that pretends the tool exists. The agent will then describe actions it cannot take.

The publisher is a stranger and the job is irreversible

High stars on a plugin and high downloads on a skill mean the listing spread. They do not mean someone you trust ran it. For a reversible job, such as drafting a heading outline you will edit, a new publisher is a reasonable experiment. For an irreversible job, such as sending email, paying an invoice, deleting files, or submitting a bid, wait until you can name the publisher and you have run the skill on a fake input.

Business Operations cards that check a bid against a tender are a good example. They are useful when you still read the result. They are dangerous when you let the agent decide the bid is consistent and you submit it. The skill does not sign your name. You do.

A plain rule

If you would not hand the same instructions and the same files to a new contractor on their first afternoon, do not hand them to the skill. Close the page. The directory will still be here after you have a smaller, safer version of the task.

Category-sized warnings

Some shelves are legitimate and still easy to misuse, so the warning belongs on the shelf and not only on one card.

Content Creation skills that write a song, a story, or a product page will imitate a style you paste in. Do not paste a living author's chapter and ask for "the same but mine" if you intend to publish the result as original. Do not install a story skill to finish a client's unpaid draft you do not have the rights to rewrite. The skill will not know the contract.

Office Efficiency skills that drive a cloud document suite can rewrite a shared folder. The first run belongs in a personal test document with a name that starts with scratch. If the prompt offers to "organize the drive," the blast radius is every file the account can see, including files other people own. Decline that prompt even if the rest of the skill is useful.

Education skills that build a lesson plan from a short brief will invent learning objectives and timings. That is helpful as a draft and dishonest if you submit it as a record of a class you already taught. Do not install one to backfill paperwork after the fact.

Design & Media skills that emit HTML from product photos will inline remote images or invent reviews. Check the output for claims that were not in your copy. A detail page that says "customers love" when you supplied no reviews is a listing problem, not a CSS problem.

IT Ops & Security skills that read packet captures can contain credentials that were sent in the clear, session cookies, and other people's traffic if you captured on a shared network. Do not upload a raw capture to find out what the skill does. Trim it to the flow you understand, on a host you are allowed to inspect.

The almost-acceptable case

Sometimes the job is real and the card is almost right. Keep the part you can defend and drop the install. Copy the two sentences from the prompt that describe the output format into your own project rules, and leave out the sentences that demand a key or a role. You have then used the directory as a catalog of ideas, which is what the card is good for, without running the publisher's full instructions. The checklist still applies to those two sentences: they should name an artifact and a refusal.

If you are unsure, do not install "just overnight to see." Overnight runs are how a prompt with file access meets a cron job or a long agent loop. Try it while you are watching, on data you can delete.