Check where an agent skill gets installed

A skill can carry instructions, scripts and references that influence an agent's work. Its installation directory matters: a project skill belongs with one repository, while a user-level skill can affect work elsewhere.

The original post warned about global installation defaults. That behavior is installer-specific. The Vercel skills CLI documents a global flag for installing into the user directory instead of the project; do not assume every skill tool uses the same default. ^[1]

Check before accepting an install

Read the skill and any scripts it invokes. Confirm the source repository, intended agent and destination directory in the installer. Prefer project scope when the instructions only make sense for that codebase.

After installing, inspect the files that changed. A design checklist should not unexpectedly add a credential-reading script or instructions to upload private files. Keep the source and revision recorded so a later update can be reviewed.

For a first trial, use a disposable repository without production credentials. Give the agent a small task, inspect its actions, and only then decide whether the skill belongs in your everyday setup.