Individual skill
vetting-outside-code-and-models
Checks dependencies, models, APIs, SaaS tools, generated files, and vendor claims against how you will actually use them, the proof you have, the gaps, and the release impact. Use when any of these affect evidence, permissions, data, releases, or public trust. Do not use for an internal cleanup with no outside dependency, or for a does-it-work question.
skills/vetting-outside-code-and-models/SKILL.md
Source commit e44af0e5811e11a3601625cf657d257915689deb
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 33
- Repository last updated
- Nov 6, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- ai-safety Repository topic
- coding-agents Repository topic
- configuration-management Repository topic
- developer-tools Repository topic
- prompt-engineering Repository topic
- software-engineering Repository topic
- data Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Vetting Outside Code and Models
## Overview
Trusting outside code is really a decision about how you will use it. A dependency, model, API, SaaS tool (software you rent online), or vendor claim should be accepted only for the job its evidence and controls actually support. Trust it for that job. Do not trust it past that.
## Decision contract
- **Claim checked:** the dependency, model, API, or SaaS is accepted only for a use no broader than repo-side evidence supports, its critical characteristics independently verified by a named acceptance method, vendor claims kept apart from proof, each gap given a re-check trigger or routed to a release decision; a critical characteristic that cannot be independently verified blocks acceptance.
- **Artifact observed:** the named dependency/version/provider, vendor claims, and own-repo evidence -> a supplier-trust section or `supplier-trust.md` with the use decision, gaps, backup controls, and release impact.
- **Decision affected:** block -- whether to trust and use the dependency, model, API, or SaaS; unresolved gaps feed `ship.md` defer/block/ship-with-risk.
- **Failure class:** boundary-overreach (trust stated past repo-side evidence, or vendor marketing treated as proof).
- **Next action:** route the unresolved gap to `ship.md`; credentials, production data, or security/privacy claims escalate to a qualified review.
