Use this before installing an agent skill or plugin. Skill Risk Check scans local files for hidden instructions, broad permissions, suspicious downloads, prompt-injection patterns, and possible secret exposure, then returns ranked findings with file-and-line evidence and remediation. Do not use it as a safety certification; it never runs, installs, enables, or uploads the target.
Install
- 1Add it in ChatGPT
Open Plugins in the ChatGPT sidebar (web or desktop), search for “Skill Risk Check” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.
Skills 1
- agent-skillguard
Use before installing an agent skill or plugin. Scan local files for risky instructions, broad permissions, suspicious downloads, prompt-injection patterns, and possible secret exposure; return file-and-line findings and remediation without running, uploading, or certifying the target.
Things to ask
- “I found a viral skill repo on Twitter. Before I install it, audit the public repo and flag anything unsafe.”
- “Audit this plugin's scripts, permissions, and external calls. Rank risks with file-and-line evidence.”
- “Give me a go-or-no-go. List what blocks installation, what must be fixed, and what I still need to review.”
Disconnect or uninstall
- 1In ChatGPT
Disconnect an account in Settings → Apps or Plugins. To remove the plugin itself, open Skill Risk Check in the Plugin Directory and select Uninstall plugin. Uninstalling can disconnect every account connected through it, and plugins your workspace installs may not offer the option.
- 2In Codex
Run /plugins in the Codex CLI, select the plugin and uninstall it, or press Space to turn it off.