# Install Agent Contribution Preflight

Canonical guide: https://vulragrag-star.github.io/agent-contribution-preflight/install/

Source repository: https://github.com/vulragrag-star/agent-contribution-preflight

Canonical Skill source: https://github.com/vulragrag-star/agent-contribution-preflight/blob/main/skills/agent-contribution-preflight/SKILL.md

Last verified: 2026-09-02

Agent Contribution Preflight is a read-only awareness skill. It inspects a target GitHub repository and thread for contribution policy, maintainer precedent, AgentScan-style controls, and machine-targeted hidden content before an external write. It reports evidence to the human owner and pauses. It does not optimize detector scores, conceal automation, impersonate a person, or bypass repository policy.

## Requirements

- Python 3.10 or newer.
- An authenticated GitHub CLI (`gh auth status`) for remote inspection.
- No third-party Python packages for local inspection.

## Install with the cross-agent Skills CLI

```console
npx skills add vulragrag-star/agent-contribution-preflight --skill agent-contribution-preflight
```

## Install with a compatible GitHub CLI

Use this only if `gh skill --help` is available in your GitHub CLI build:

```console
gh skill install vulragrag-star/agent-contribution-preflight agent-contribution-preflight
```

If the command is unavailable, use the Skills CLI or manual installation.

## Install the versioned release archive

Download the `v1.0.0` archive and its checksum from GitHub Releases:

- https://github.com/vulragrag-star/agent-contribution-preflight/releases/download/v1.0.0/agent-contribution-preflight-skill-v1.0.0.zip
- https://github.com/vulragrag-star/agent-contribution-preflight/releases/download/v1.0.0/SHA256SUMS

Verify the SHA-256 checksum before extracting the top-level `agent-contribution-preflight/` directory into an agent's supported skills directory.

## Manual installation

1. Clone `https://github.com/vulragrag-star/agent-contribution-preflight.git`.
2. Review `skills/agent-contribution-preflight/SKILL.md`, the referenced Markdown files, and `scripts/inspect_target.py`.
3. Copy the complete `skills/agent-contribution-preflight/` directory into the target agent's supported skills directory. Keep `SKILL.md`, `references/`, `scripts/`, and `agents/` together.

## Run the inspector

Inspect a local checkout:

```console
python skills/agent-contribution-preflight/scripts/inspect_target.py --local /path/to/repository
```

Inspect a public repository and a numbered issue or pull-request thread:

```console
python skills/agent-contribution-preflight/scripts/inspect_target.py --repo owner/repository --thread 123 --format json
```

Exit codes:

- `0`: no public signal observed. This is not proof that no App, silent mode, custom label, or maintainer-side browser tool exists.
- `1`: inspection failed, was incomplete, or received invalid input. Correct it or inspect a local clone before drawing a clean conclusion.
- `2`: an AgentScan or related repository signal was observed. Pause the external write and brief the owner.
- `3`: machine-targeted hidden content was observed. Human review is required before any reply; do not echo the hidden instruction body.

## Safety boundary

- All external GitHub writes remain owner-approved actions.
- Repository policy takes precedence at the contribution boundary.
- A flagged thread is a hard stop for autonomous public communication.
- Local comprehension, reproduction, debugging, research, testing, and review should continue when the user's authorization and repository policy permit them.
- Do not tune timing, wording, branch names, account fields, commit metadata, or repository selection to influence a detector.
- Do not conceal AI involvement, impersonate a human, interfere with reports, or automate a response to a detector.

Machine-readable discovery metadata is available at https://vulragrag-star.github.io/agent-contribution-preflight/agent-skill.json. It is self-describing metadata and is not claimed as a cross-vendor standard.