← All skills
isolated-setup-install
49 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By apache/magpie (GitHub) · security · 146 stars · scanned at commit 8d24b52
Walk an adopter through the first-time install of the secure agent setup (sandbox, approval and clean-environment layers) for Claude Code, Codex, Antigravity, Pi or Goose. Interactive throughout; never runs sudo, edits a shell rc, or overwrites settings on its own.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: example.com
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 12 places.
Show 9 more
- docs/quick-start/other-install-methods.md, line 127
curl -fsSLO ${REL_BASE}/${ZIP}.sha512 - docs/quick-start/other-install-methods.md, line 128
curl -fsSLO ${REL_BASE}/${ZIP}.asc - docs/rfcs/RFC-AI-0002.md, line 440
curl https://example.com # → blocked by permissions.deny - docs/rfcs/RFC-AI-0002.md, line 464
`curl https://example.com` and confirm each is denied. - docs/setup/secure-agent-setup.md, line 717
"WebFetch(domain:cveawg.mitre.org)", "WebFetch(domain:pypi.org)" - docs/setup/secure-agent-setup.md, line 3802
curl https://example.com # → blocked by permissions.deny - docs/setup/secure-agent-setup.md, line 3892
`claude-iso`. (c) `curl https://example.com` is denied. - docs/setup/secure-agent-setup.md, line 4260
missing (new vetted-ops read forms, MCP read tools, WebFetch - docs/setup/secure-agent-setup.md, line 4272
variable names only, 7c `curl https://example.com`) and confirm
Downloads and installs other software
The author does not mention this.
Found in 66 places.
Show 17 more
- plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 30
"Bash(uvx --from ~/.claude/magpie/vetted-ops vetted-op-read *)" - plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 34
"Bash(uvx --from ~/.claude/magpie/vetted-ops vetted-op *)", - plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 36
"Bash(uvx --from ~/.claude/magpie/vetted-ops vetted-op-tracker *)" - plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 61
`"uvx --from ~/.claude/magpie/vetted-ops vetted-op-read *"`). Skills document `uv run --project`; read-only - plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 62
gatherer agents use `uvx --from`, because `uv run` in the plugin cache - plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 67
(`"uv run --project ~/.claude/magpie/vetted-ops vetted-op-tracker *"`, `"uvx --from ~/.claude/magpie/vetted-ops vetted-op-tracker *"`, - plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 68
`"uv run --project ~/.claude/magpie/vetted-ops vetted-op *"` and `"uvx --from ~/.claude/magpie/vetted-ops vetted-op *"`): - plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 129
MUST be allowed for each launcher in {`uvx --from`, `uv run --project`}: - plugins/magpie-setup/skills/isolated-setup-install/step-v-vetted-ops.md, line 138
a broad rule such as `Bash(uvx *)` counts. An ask rule prompts even when - docs/adapters/codex.md, line 206
Before the rules run, the hook rewrites a command only when the whole command is one read call in that spelling — `uv run --project ~/.claude/magpie/vetted-ops - docs/adapters/codex.md, line 211
Both `uv run --project <installed-path> vetted-op-read` and `uvx --from <installed-path> vetted-op-read` are `allow`. - docs/adapters/codex.md, line 213
There is no general `uv` or `uvx` allow rule and no catalogue-wide write exemption. - docs/adapters/copilot.md, line 74
npm install -g @github/copilot - docs/rfcs/RFC-AI-0002.md, line 196
"Bash(pip install --upgrade *)", "Bash(uv self update *)" - docs/rfcs/RFC-AI-0002.md, line 358
sudo apt-get install --no-install-recommends \ - docs/rfcs/RFC-AI-0002.md, line 366
sudo dnf install \ - docs/rfcs/RFC-AI-0002.md, line 371
**macOS:** bubblewrap is not needed (Seatbelt is built in); socat is optional. If you want socat, `brew install socat` (no pin enforced — Homebrew rolls forward
and 46 more places
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed. Expected for a security skill.
Found in 13 places.
Show 10 more
- docs/setup/sandbox-troubleshooting.md, line 1036
- Any wrapper that spawns `gh` as a child — `sh -c`, a Makefile - tools/agent-guard/README.md, line 139
| `lefthook-hooks-path` | `setup-isolated-setup-install` | `lefthook install --force` / `-f` or `--reset-hooks-path` / `-r` while the global `core.hooksPath` is - tools/agent-guard/README.md, line 166
A shell's `-c` string (`bash -c "…"`, `sh -c '…'`, `zsh -lc "…"`), or the joined arguments of `eval` (after one `--`; also behind any chain of `builtin`, `comma - tools/skill-evals/README.md, line 165
--cli "bash -c 'opencode run \"$(cat)\"'" \ - tools/skill-evals/README.md, line 309
--cli "bash -c 'opencode run \"$(cat)\"'" \ - tools/skill-evals/README.md, line 318
--cli "bash -c 'opencode run --model anthropic/claude-sonnet-4-5 \"$(cat)\"'" \ - tools/skill-evals/README.md, line 328
--cli "bash -c 'opencode run \"$(cat)\"'" \ - tools/skill-evals/README.md, line 340
--cli "bash -c 'opencode --pure run \"$(cat)\"'" \ - plugins/magpie-setup/hooks/codex-hooks.json, line 10
"command": "/bin/bash -p \"${PLUGIN_ROOT}/hooks/check-upgrade.sh\"", - plugins/magpie-setup/hooks/hooks.json, line 11
"command": "/bin/bash -p \"${CLAUDE_PLUGIN_ROOT}/hooks/check-upgrade.sh\"",
Changes files outside its own folder
The author does not mention this.
Found in 43 places.
Show 17 more
- docs/adapters/antigravity.md, line 142
| `touch ~/probe` | Blocked. | - docs/adapters/goose.md, line 97
| `touch ~/probe` | Blocked. | - docs/adapters/goose.md, line 98
| `echo x >> ~/.config/goose/config.yaml` | Blocked: Goose's configuration is read-only inside. | - docs/adapters/pi.md, line 111
| `touch ~/probe` | Blocked. | - docs/quick-start/other-install-methods.md, line 146
mkdir -p .agents/skills .claude/skills .github/skills - docs/quick-start/other-install-methods.md, line 148
ln -sf ../../.agents/skills/magpie-setup .claude/skills/magpie-setup - docs/quick-start/other-install-methods.md, line 224
mkdir -p .agents/skills .claude/skills .github/skills - docs/quick-start/other-install-methods.md, line 226
ln -sf ../../.agents/skills/magpie-setup .claude/skills/magpie-setup - docs/quick-start/other-install-methods.md, line 255
mkdir -p .agents/skills .claude/skills .github/skills - docs/quick-start/other-install-methods.md, line 257
ln -sf ../../.agents/skills/magpie-setup .claude/skills/magpie-setup - docs/setup/sandbox-troubleshooting.md, line 483
`~/.claude/scripts/gpg-touch-overlay.sh -> ~/.claude-config/scripts/gpg-touch-overlay.sh`, - docs/setup/secure-agent-setup.md, line 972
mkdir -p ~/.config/apache-magpie/vetted-ops && cp .apache-magpie-overrides/tools/vetted-ops/config.toml ~/.config/apache-magpie/vetted-ops/<project>.toml - docs/setup/secure-agent-setup.md, line 1639
mkdir -p ~/.claude/agent-isolation - docs/setup/secure-agent-setup.md, line 1788
mkdir -p ~/.claude/scripts - docs/setup/secure-agent-setup.md, line 1902
mkdir -p ~/.claude/scripts/guards.d - docs/setup/secure-agent-setup.md, line 1909
cp /path/to/magpie/skills/*/guards/*.py ~/.claude/scripts/guards.d/ 2>/dev/null || true - docs/setup/secure-agent-setup.md, line 2069
mkdir -p ~/.claude/scripts
and 23 more places
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this.
Found in 30 places.
Show 17 more
- docs/adapters/goose.md, line 144
| Run exactly `cat ~/.ssh/known_hosts`. | Fails inside the sandbox. | - docs/adapters/pi.md, line 109
| `cat ~/.ssh/known_hosts` | Blocked. | - docs/adapters/pi.md, line 155
| Run exactly `cat ~/.ssh/known_hosts`. | Fails inside the sandbox. | - docs/rfcs/RFC-AI-0002.md, line 140
The visible result is precise: a `cat ~/.aws/credentials` from inside the sandbox returns `No such file or directory`, not `Permission denied`. The path doesn't - docs/rfcs/RFC-AI-0002.md, line 171
"~/.gnupg/", // gpg keys (commit signing) - docs/rfcs/RFC-AI-0002.md, line 187
"Read(~/.aws/**)", "Read(~/.ssh/**)", "Read(~/.netrc)", - docs/rfcs/RFC-AI-0002.md, line 188
"Read(~/.docker/**)", "Read(~/.kube/**)", - docs/rfcs/RFC-AI-0002.md, line 191
"Read(~/.config/gcloud/**)", "Read(~/.azure/**)", - docs/rfcs/RFC-AI-0002.md, line 438
cat ~/.aws/credentials # → permission denied (sandbox) - docs/rfcs/RFC-AI-0002.md, line 463
7. Run `cat ~/.aws/credentials`, `echo $AWS_ACCESS_KEY_ID`, and - docs/setup/sandbox-troubleshooting.md, line 241
error: No private key found for public key "~/.ssh/<key>.pub"? - docs/setup/sandbox-troubleshooting.md, line 380
"~/.ssh/id_ed25519_sk.pub" // the file `git config --get user.signingkey` prints - docs/setup/secure-agent-setup.md, line 562
"~/.gnupg/", // gpg keyring reads (needed for signing, not sufficient on Linux — see sandbox-troubleshooting.md) - docs/setup/secure-agent-setup.md, line 564
"~/.ssh/id_ed25519_sk.pub" // ONLY with `gpg.format=ssh`: the public half git hands to `ssh-keygen -Y sign`. Use the file `git config user.signingkey` names - docs/setup/secure-agent-setup.md, line 720
"Read(~/.aws/**)", "Read(~/.ssh/**)", "Read(~/.netrc)", - docs/setup/secure-agent-setup.md, line 721
"Read(~/.docker/**)", "Read(~/.kube/**)", - docs/setup/secure-agent-setup.md, line 725
"Read(~/.config/gcloud/**)", "Read(~/.azure/**)",
and 10 more places
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'isolated-setup-install' ] || [ -L ~/.agents/skills/'isolated-setup-install' ]; then echo 'A skill folder named isolated-setup-install already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/apache/magpie' "$d" && git -C "$d" checkout --quiet '8d24b52457f7a2731d7cc3329af96430a16715fd' -- 'plugins/magpie-setup/skills/isolated-setup-install' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/magpie-setup/skills/isolated-setup-install' ~/.agents/skills/'isolated-setup-install' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'isolated-setup-install' ~/.claude/skills/'isolated-setup-install' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for apache/magpie shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/apache/magpie/)
Score history
| Date | Version | Score |
|---|
| 2026-11-13 | 8d24b52 | 49 |
| 2026-11-09 | 3fd660b | 49 |
| 2026-11-07 | c099f3f | 95 |