gh skill: what to check before installing agent skills

`gh skill` turns GitHub repositories into an agent-skill install surface. That is convenient, but it should still be handled like a supply-chain workflow, not a copy-paste shortcut.

Check The CLI Version

GitHub documents `gh skill` as public preview and requires GitHub CLI 2.90.0 or later. Check `gh --version` and `gh skill --help` before writing team onboarding around it.

Preview Before Install

Use `gh skill search` to find leads, then `gh skill preview` to inspect the `SKILL.md` and file tree. GitHub warns that skills are not verified and may contain prompt injections, hidden instructions, or malicious scripts.

• Open the original repository.
• Read the full instructions and supporting files.
• Reject vague skills that ask for broad workspace trust.

Scope And Pin Deliberately

Install project skills for repo-specific standards and user skills only for workflows you trust across projects. Pin reviewed production skills to a tag or commit so updates are deliberate.

Review Updates Like Code

`gh skill update` compares local metadata with upstream changes. Run `--dry-run` first, review the source diff, and avoid force updates when local files were edited intentionally.

Publish With Dry Runs

Maintainers should validate with `gh skill publish --dry-run`, use clear release tags, and document what the skill should not do before asking teams to install it.