setup

39 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By b-open-io/prompts (GitHub) · security · 15 stars · scanned at commit f4b302a

Audit which bOpen plugins, CLIs, env keys, third-party skills, agents, and hooks are installed across the harness, then emit a runtime-tailored instruction plan with optional user-triggered installation of selected dependencies. Use for "bopen setup", "setup ui", "harness install", "audit my setup", "install everything", or "unified installer". For a single hook, use hook-manager.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed. Expected for a security skill.

Found in 46 places.

skills/setup/SKILL.md, line 51bun skills/setup/scripts/playground_server.ts --runtime <claude|codex|grok|opencode|hermes|generic> [--pack <toc.json|pack.json>]
skills/setup/SKILL.md, line 60portless agent-master bun skills/setup/scripts/playground_server.ts --runtime <claude|codex|grok|opencode|hermes|generic> --agent-master
skills/setup/SKILL.md, line 80bun skills/setup/scripts/server.ts --runtime <claude|codex|grok|opencode|hermes|generic> [--pack <toc.json|pack.json>] [--port 7788]

Show 17 more

skills/setup/playground/src/app/api/pack/install/route.ts, line 1import { execFile } from "node:child_process"
skills/setup/playground/src/lib/agent-master-interfaces.ts, line 1import { type ChildProcess, spawn, spawnSync } from "node:child_process"
skills/setup/playground/src/lib/agent-master-interfaces.ts, line 268const result = spawnSync(portless, ["get", portlessName], {
skills/setup/playground/src/lib/app-update-install.ts, line 16import { execFile, spawn } from "node:child_process"
skills/setup/scripts/detector.ts, line 263const proc = Bun.spawn(["sh", "-c", check], {
skills/setup/scripts/emitter.test.ts, line 447const result = Bun.spawnSync(["sh", "-n"], { stdin: Buffer.from(match[1]) });
skills/setup/scripts/emitter.test.ts, line 483return Bun.spawnSync(["sh", "-ec", block.split("\nopencode debug")[0]], {
skills/setup/scripts/emitter.test.ts, line 504const result=Bun.spawnSync(['sh','-c',block![1]],{cwd:project});expect(result.exitCode).toBe(0);
skills/setup/scripts/playground_server.ts, line 58const check = Bun.spawnSync(["bun", "--version"], { stdout: "pipe", stderr: "pipe" });
skills/setup/scripts/playground_server.ts, line 66const proc = Bun.spawnSync(cmd, {
skills/setup/scripts/playground_server.ts, line 102const proc = Bun.spawn(["bun", "--bun", "next", "start", "-H", host, "-p", String(port)], {
hooks/claude-hooks.json, line 9"command": "BOPEN_HOOK_SCRIPT=\"${CLAUDE_PLUGIN_ROOT}/hooks/session-context.sh\"; if [ ! -f \"$BOPEN_HOOK_SCRIPT\" ]; then BOPEN_HOOK_SCRIPT=$(ls -t \"$HOME/.cl
hooks/claude-hooks.json, line 14"command": "BOPEN_HOOK_SCRIPT=\"${CLAUDE_PLUGIN_ROOT}/hooks/repo-freshness.sh\"; if [ ! -f \"$BOPEN_HOOK_SCRIPT\" ]; then BOPEN_HOOK_SCRIPT=$(ls -t \"$HOME/.cla
hooks/claude-hooks.json, line 25"command": "BOPEN_HOOK_SCRIPT=\"${CLAUDE_PLUGIN_ROOT}/hooks/prompt-router.sh\"; if [ ! -f \"$BOPEN_HOOK_SCRIPT\" ]; then BOPEN_HOOK_SCRIPT=$(ls -t \"$HOME/.clau
hooks/claude-hooks.json, line 37"command": "BOPEN_HOOK_SCRIPT=\"${CLAUDE_PLUGIN_ROOT}/hooks/pretooluse-bash.sh\"; if [ ! -f \"$BOPEN_HOOK_SCRIPT\" ]; then BOPEN_HOOK_SCRIPT=$(ls -t \"$HOME/.cl
hooks/claude-hooks.json, line 47"command": "BOPEN_HOOK_SCRIPT=\"${CLAUDE_PLUGIN_ROOT}/hooks/damage-control.sh\"; if [ ! -f \"$BOPEN_HOOK_SCRIPT\" ]; then BOPEN_HOOK_SCRIPT=$(ls -t \"$HOME/.cla
hooks/claude-hooks.json, line 57"command": "BOPEN_HOOK_SCRIPT=\"${CLAUDE_PLUGIN_ROOT}/hooks/agent-browser-solo.sh\"; if [ ! -f \"$BOPEN_HOOK_SCRIPT\" ]; then BOPEN_HOOK_SCRIPT=$(ls -t \"$HOME/

and 26 more places

Downloads and installs other software

The author does not mention this.

Found in 51 places.

skills/setup/SKILL.md, line 67globally (`npm install -g portless`); do not add it to the plugin dependencies.
skills/setup/SKILL.md, line 134portable `npx skills add`-style instructions only, no runtime-specific agent
skills/setup/assets/manifest.schema.json, line 26"description": "Skills installed via `npx skills add` (or similar) from an external source rather than shipped inside this plugin.",

Show 17 more

skills/setup/assets/manifest.schema.json, line 109"description": "The exact command that installs this skill, e.g. an `npx skills add` invocation."
skills/setup/playground/src/lib/pack-catalog.ts, line 106install: "npx skills add shadcn (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 116install: "npx skills add web-design-guidelines (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 122"npx skills add vercel-react-best-practices (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 127install: "npx skills add macos-design (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 132install: "npx skills add accessibility-a11y (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1106"npx skills add vercel-react-native-skills (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1111install: "npx skills add webapp-testing (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1122"npx skills add better-auth-security-best-practices (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1128"npx skills add two-factor-authentication-best-practices (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1134"npx skills add email-and-password-best-practices (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1139install: "npx skills add react-doctor (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1154install: "npx skills add convex-realtime (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1159install: "npx skills add convex-functions (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1164install: "npx skills add convex-file-storage (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1174install: "npx skills add convex-cron-jobs (source pinned in the pack setup manifest)",
skills/setup/playground/src/lib/pack-catalog.ts, line 1516"Orbit runs the MCP publish checklist — npx compatibility, package.json fields, discovery metadata, install docs — so the server installs cleanly on a teammate'

and 31 more places

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 43 places.

skills/setup/assets/ui.html, line 520return fetch("/api/state").then(function (res) {
skills/setup/assets/ui.html, line 557fetch("/api/plan", {
skills/setup/playground/scripts/vendor-audio.ts, line 45const response = await fetch(url);

Show 17 more

skills/setup/playground/src/app/page.tsx, line 55const res = await fetch("/api/state")
skills/setup/playground/src/app/page.tsx, line 155const res = await fetch("/api/plan", {
skills/setup/playground/src/components/SoundProvider.tsx, line 79void fetch(path, { signal: abortController.signal })
skills/setup/playground/src/components/packs/MyPacksTab.tsx, line 128const response = await fetch("/api/agent-master/packs", {
skills/setup/playground/src/components/packs/MyPacksTab.tsx, line 193const response = await fetch("/api/agent-master/device/token", {
skills/setup/playground/src/components/packs/MyPacksTab.tsx, line 233const response = await fetch("/api/agent-master/device/code", {
skills/setup/playground/src/components/setup/PackDependenciesTab.tsx, line 43const response = await fetch("/api/pack/install", {
skills/setup/playground/src/components/setup/UpdateBanner.tsx, line 32const response = await fetch("/api/agent-master/update", { cache: "no-store" })
skills/setup/playground/src/components/setup/UpdateBanner.tsx, line 63const response = await fetch("/api/agent-master/update/install", {
skills/setup/playground/src/components/setup/UpdateBanner.tsx, line 84const response = await fetch("/api/agent-master/update/install", {
skills/setup/playground/src/lib/agent-master-interfaces.test.ts, line 43fetch() {
skills/setup/playground/src/lib/agent-master-interfaces.test.ts, line 61fetch() {
skills/setup/playground/src/lib/agent-master-interfaces.test.ts, line 81fetch(request) {
skills/setup/playground/src/lib/agent-master-interfaces.ts, line 325const response = await fetch(publicUrl, {
skills/setup/playground/src/lib/bopen-device.ts, line 16const upstream = await fetch(`${BOPEN_ORIGIN}${path}`, {
skills/setup/scripts/detector.test.ts, line 502fetch() {
skills/setup/scripts/detector.test.ts, line 522fetch() {

and 23 more places

Changes files outside its own folder

The author does not mention this. It runs automatically when the plugin is installed.

Found in 8 places.

skills/setup/playground/src/lib/app-update-install.test.ts, line 58const discard = script.indexOf('/bin/rm -rf "$target.previous"\n/usr/bin/open')
hooks/hammertime.py, line 637with open(os.path.expanduser(debug_path), "a") as f:
hooks/tests/test_damage_control.sh, line 86input=$(jq -n '{tool_name:"Bash", tool_input:{command:"rm /tmp/x && cat ~/.claude/plugins/foo"}}')

Show 5 more

hooks/tests/test_damage_control.sh, line 92input=$(jq -n '{tool_name:"Bash", tool_input:{command:"rm -rf ~/.claude"}}')
hooks/tests/test_damage_control.sh, line 99input=$(jq -n '{tool_name:"Bash", tool_input:{command:"rm ~/.claude/settings.json"}}')
hooks/tests/test_pretooluse_bash.sh, line 33input=$(jq -n '{tool_name:"Bash", tool_input:{command:"rm /tmp/x && cat ~/.claude/plugins/foo"}}')
hooks/tests/test_pretooluse_bash.sh, line 39input=$(jq -n '{tool_name:"Bash", tool_input:{command:"rm -rf ~/.claude"}}')
hooks/tests/test_skill_activity.sh, line 17mkdir -p "$HOME"

Can call paid AI services billed to you

The author does not mention this. It runs automatically when the plugin is installed.

Found in 1 place.

hooks/hammertime.py, line 476"https://api.anthropic.com/v1/messages",

Reads your saved credentials, such as SSH keys or .env files

The author does not mention this. It runs automatically when the plugin is installed.

Found in 2 places.

hooks/patterns.yaml, line 15- "~/.ssh/"
hooks/patterns.yaml, line 16- "~/.aws/"

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'setup' ] || [ -L ~/.agents/skills/'setup' ]; then echo 'A skill folder named setup already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/b-open-io/prompts' "$d" && git -C "$d" checkout --quiet 'f4b302aadb0c99023b03e1f1b38ffed3697fbedf' -- 'skills/setup' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/setup' ~/.agents/skills/'setup' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'setup' ~/.claude/skills/'setup' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for b-open-io/prompts shows the score of its lowest-scoring skill.

SkillTrust badge for b-open-io/prompts

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/b-open-io/prompts.svg)](https://zalavijaysinh.github.io/skilltrust/repos/b-open-io/prompts/)

Score history

Date	Version	Score
2026-11-08	`f4b302a`	39
2026-11-06	`f4b302a`	39