Skip to main content
This list covers official documentation entry points, cross-tool standards, community discovery resources, security scanning tools, and researcher workflow tools. For the evaluation framework see 03-1, 03-2, and 03-3. Apply those three sections’ scanning SOP before installing any third-party resource.
Links and content verified as of 2026-06; treat each vendor’s official page as the authoritative source. Community resources change at any time; appearing here means only “was included,” not “worth installing.”

​
Standard SOP for using community resources

When you encounter a popular Skill / Plugin / MCP server, follow these seven steps:
  1. Source review: Is the author named? What organization? How long since the last commit? Is the issue tracker active?
  2. File review: Read SKILL.md / plugin.json / .mcp.json / hooks.json in full. Do the first 50 lines contain suspicious commands or outbound connections?
  3. Permission review: Does it write files? Connect to the network? Require a token? Does the task actually need any of that?
  4. Isolated test: Install it first in a throwaway environment or container, run one empty task, and observe network and file behavior.
  5. Scan: Run the three rg scans from the security tools section. Do not skip any hit.
  6. Track: Follow the author’s releases. Re-run all five steps before upgrading.
  7. Document: Write the review findings into MEMORY.md or project documentation. When a colleague asks whether it is safe to install, hand them the record directly.