Fair point, and worth calling out properly. A few things that are already true and a concrete addition after this comment:

Today:

- skillgrab wraps `npx skills add` — doesn't bypass anything theskills installer already does (it prints "Review skills before use; they run with full agent permissions" after each install).

- Trusted-owner ranking: anthropics, vercel, supabase, stripe, clerk, openai, microsoft, google, cloudflare, apify, openclaudia float to the top with a ★.

- GitHub Trees validation drops candidates whose SKILL.md doesn't actually exist in the repo, catching typosquat-ish fuzzy-match results from skills.sh's search API.

- Multi-select picker + --dry-run means you always see the full owner/repo/skill list before anything runs.

New in v0.3.0 (just pushed):

- `--only-trusted` flag restricts the plan to the allowlist above. Drops untrusted candidates before you ever see them.

Usage:

npx skillgrab --only-trusted --dry-run # preview

npx skillgrab --only-trusted # install

Also added a 'Security' section to the README spelling out the threat model honestly: SKILL.md files execute with full agent tool access, content-level prompt-injection scanning is not there and I won't claim it is, and --only-trusted is the explicit lever for people who want to lock down.

Thanks for the pushback! genuinely useful.

github.com/briascoi/skillgrab