GetSkillary

Use case / SBPA-005

Inspect a package or repository before installing

User Problem

A user wants a pre-install review of a placeholder package or repository before running anything.

Proof Claim Boundary

First-party operator dogfooding and product capability evidence only. The package snapshot was synthetic. This is not a vulnerability audit, penetration test, security certification, or no-risk guarantee. Independent verification has not been completed, third-party corroboration is absent, and no evidence of natural user demand has been established. This does not establish SEO or GEO success, AI citation, AI recommendation, traffic, lead, revenue, or conversion improvement.

Manual install only: yes. Hosted execution: false.

Sanitized Prompt

I want Codex to inspect a sample package or repository before installation and return risks, setup notes, and a proceed/no-proceed boundary.

Direct answer

What Workflow Fits This Scenario?

Problem
Use this workflow to inspect a package or repository snapshot before installation without executing untrusted code.
Suitable workflow
The suitable workflow is a static, non-executing review of the manifest, lifecycle scripts, dependencies, permission or credential requirements, maintenance signals, risks, and unknowns.
Codex + GetSkillary MCP
Codex can use GetSkillary MCP to select the pre-install review solution and its three-skill bundle, then produce a bounded proceed, hold, or escalate recommendation from the supplied snapshot. The MCP endpoint does not install the package.
When to use
Use it before a manual install when package metadata and source are available for read-only inspection and the decision needs explicit unknowns and risk boundaries.
When not to use
Do not treat it as a vulnerability audit, penetration test, security certification, or guarantee that a package is safe.
Next step
Review the manifest, scripts, dependencies, permission or credential needs, maintenance signals, and unknowns; choose proceed, hold, or independent security review before any separately authorized install.

Neutral selection criteria

Choose The Smallest Suitable Workflow

Use the coding agent's native capability

Use when: The package is simple, the reviewer can provide a complete snapshot, and a one-off static explanation is sufficient.

Boundary: The user must define the no-execution boundary and verify that the agent does not run package code.

Use one skill

Use when: The exact need is narrow, such as package metadata discovery, and no combined quality or codebase review is needed.

Boundary: One skill may not cover scripts, dependencies, permissions, maintenance, and decision boundaries together.

Use the GetSkillary solution, bundle, and MCP workflow

Use when: The request needs a repeatable static pre-install checklist, a matched bundle, and a bounded decision output.

Boundary: Manual installation support only; no package script, npm install, global install, hosted execution, or automatic network action.

Use a human expert or independent security review

Use when: The package has privileged access, sensitive credentials, opaque binaries, material supply-chain risk, or high-impact deployment context.

Boundary: Independent security assurance requires a separately scoped review and cannot be inferred from this static operator test.

Bounded first-party evidence

What The Operator Test Supports

Evidence status
bounded_first_party_operator_evidence_verified
Test date
2026-07-10
operator_tested
true
Verification
13/13 listed artifacts and 5/5 bounded evidence sources were present, and the static pre-install review verifier passed the defined checks.
manual_install_only
true
hosted_execution
false
third_party_corroboration_status
absent
Natural user demand
Not proven
Independent validation of GetSkillary
None

Allowed Bounded Claims

  • SBPA-005-C01: In an operator-run test, the MCP workflow matched a sanitized pre-install review request to the documented solution and skill bundle.
  • SBPA-005-C02: A local operator test produced a static pre-install review, risk assessment, decision boundary, and nontechnical summary from a synthetic fixture; no package install or package script execution occurred.
  • SBPA-005-C03: The listed local verifier passed the defined fixture checks, and SHA-256 hashes are included for reproducibility.

These are local operator dogfooding and product capability facts from synthetic or sanitized fixtures. They are not independent certification, market-effect evidence, or natural-user outcome evidence.

Reproducibility contract

Repeat The Bounded Test

With a synthetic package snapshot, repeat the MCP discovery path, perform static inspection only, and verify that the review covers manifest, scripts, dependencies, permissions, maintenance signals, and unknowns without installation.

Safe Input

Provide a synthetic package or repository snapshot for static pre-install review. Ask for manifest, script, dependency, permission or credential, maintenance, risk, and unknown checks. Prohibit installation and script execution.

MCP Call Path

search_solutions -> get_solution_detail -> recommend_solution_skills -> get_solution_install_plan

Codex Steps

  • Confirm that the snapshot is synthetic or authorized and keep the review read-only.
  • Inspect structure, manifest metadata, lifecycle scripts, dependencies, permission or credential indicators, and maintenance notes.
  • Record observable risks and unknowns without executing package code.
  • Produce a static review, risk assessment, decision boundary, and nontechnical summary.

Confirmation Points

  • Confirm snapshot authorization and the static no-execution boundary.
  • Confirm that no credential or production authority is supplied.
  • Require new authorization before download, install, package script execution, or network action.

Expected Outputs

  • Static pre-install review
  • Risk and unknowns assessment
  • Proceed, hold, or escalate boundary
  • Nontechnical summary

Acceptance Checklist

  • Manifest, scripts, dependencies, permission or credential needs, maintenance signals, risks, and unknowns are covered.
  • No package script is executed.
  • No npm install or global installation occurs.
  • The output does not claim vulnerability-audit coverage, certification, or a no-risk guarantee.

Actions Not Run

  • package scripts
  • npm install
  • global installation
  • untrusted code execution
  • network calls
  • credential use

Cleanup And Rollback Boundary

The static review does not install or mutate package state. Any separately authorized synthetic fixture regeneration must stay inside its verified fixture/output scope.

Sources and boundaries

Separate Background From Product Evidence

Background And Reference Sources

  • Equinor AppSec package security-screening guideline No content fact is projected from this URL because the gate's read-only fetch was unavailable. Observed source evidence only. It does not validate or endorse this GetSkillary workflow. Verification status: unavailable_during_2026-07-13_read_only_check.
  • npm documentation: Scripts Official reference for package lifecycle scripts and their execution context. General package-manager background only. npm does not validate or endorse this GetSkillary workflow. Verification status: available_read_only_2026-07-13.

GetSkillary First-Party Evidence

Three bounded operator-run claims, 13/13 listed artifacts, and 5/5 bounded evidence sources from a synthetic package fixture.

Independent Validation Of GetSkillary

None. third_party_corroboration_status=absent.

Background sources explain the surrounding method or tool category. They are not third-party corroboration of GetSkillary.

When To Use

  • Use it before a manual install when package metadata and source are available for read-only inspection and the decision needs explicit unknowns and risk boundaries.

When Not To Use

  • Do not treat it as a vulnerability audit, penetration test, security certification, or guarantee that a package is safe.

Matched Solution

Inspect a package or repository before installing is the canonical solution route for this scenario.

MCP Workflow

search_solutions -> get_solution_detail -> recommend_solution_skills -> get_solution_install_plan

Endpoint
https://mcp.getskillary.com/mcp
Manual install only
Yes
Hosted execution
No

Recommended Skill Bundle

How Codex Explains And Executes The Plan

Confirm that the snapshot is synthetic or authorized and keep the review read-only. Inspect structure, manifest metadata, lifecycle scripts, dependencies, permission or credential indicators, and maintenance notes. Record observable risks and unknowns without executing package code. Produce a static review, risk assessment, decision boundary, and nontechnical summary.

What You Need To Confirm

  • Confirm snapshot authorization and the static no-execution boundary.
  • Confirm that no credential or production authority is supplied.
  • Require new authorization before download, install, package script execution, or network action.

Expected Output

Pre-install review; risk notes; install/no-install recommendation boundary.

Verification Checklist

  • Manifest, scripts, dependencies, permission or credential needs, maintenance signals, risks, and unknowns are covered.
  • No package script is executed.
  • No npm install or global installation occurs.
  • The output does not claim vulnerability-audit coverage, certification, or a no-risk guarantee.

Risk Boundary

L0 read-only discovery. No package installation, untrusted script execution, or guarantee of safety.

manual_install_only
true
hosted_execution
false

What Was Not Done

No package was installed, no install script ran, no repository code was executed, no production system changed, and no safety guarantee was claimed.

Readiness By GEO Stage

crawl
No URL or sitemap-count change; existing crawl support only, classified as SEO supporting diagnostics.
index
Existing canonical remains indexable with no new URL; index state is not GEO evidence.
understand
Adds a static pre-install answer, neutral selection logic, and explicit no-execution boundaries.
retrieve
Strengthens package-review intent match and concrete inspection fields; actual retrieval remains unproven until live observation.
cite
Adds attributable, bounded facts and source-role labels; actual citation evidence remains absent.
click
Keeps existing solution, skill, install, MCP, and inquiry routes; no click evidence is created.
convert
No conversion evidence or conversion-improvement claim.

Next Actions

First-party operator dogfooding and product capability evidence only. The package snapshot was synthetic. This is not a vulnerability audit, penetration test, security certification, or no-risk guarantee. Independent verification has not been completed, third-party corroboration is absent, and no evidence of natural user demand has been established. This does not establish SEO or GEO success, AI citation, AI recommendation, traffic, lead, revenue, or conversion improvement.

View solution View primary skill Install guide MCP usage guide Inquiry

Tracking readiness only; no click or conversion evidence is generated by this local gate.