configure

49 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.

By yonatangross/orchestkit (GitHub) · coding · 301 stars · scanned at commit 0d38e66

Interactive wizard for OrchestKit settings: MCP servers, hook permissions, keybindings, presets. Use when customizing plugin behavior.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 6 places.

src/skills/configure/SKILL.md, line 28configure
src/skills/configure/SKILL.md, line 162export ENABLE_CLAUDEAI_MCP_SERVERS=false
src/skills/configure/SKILL.md, line 210saveConfig({ webhookUrl: "<webhook-url>" })

Show 3 more

src/skills/configure/SKILL.md, line 247Read("references/operator-scope-settings.md")
src/skills/configure/references/mcp-config.md, line 2793. Use `op read` in `.mcp.json` (see example config above) — the `sh -c` wrapper fetches the key from 1Password at MCP startup
src/skills/configure/references/mcp-config.md, line 281> **Note:** Claude Code's MCP `env` block only resolves `${ENV_VAR}` syntax, not `op://` references directly. Use the `sh -c "TAVILY_API_KEY=$(op read '...') ex

Sends data to these websites: example.com, webhook.site

This is disclosed by the author in the skill's SKILL.md or README.

Found in 2 places.

src/skills/configure/references/cc-version-settings.md, line 412curl -LO https://example.com/some-plugin.zip
src/skills/configure/references/operator-scope-settings.md, line 1463. The direct test: in a normal session, ask for `curl -s https://webhook.site/test`.

Changes files outside its own folder

The author does not mention this.

Found in 2 places.

src/skills/configure/references/cc-version-settings.md, line 790"Bash(rm -rf $HOME*)",
src/skills/configure/rules/backup-before-modify.md, line 26cat > ~/.claude/plugins/orchestkit/config.json << 'EOF'

Downloads and installs other software

The author does not mention this.

Found in 9 places.

src/skills/configure/references/cc-version-settings.md, line 794"Bash(curl * | sh)",
src/skills/configure/references/cc-version-settings.md, line 795"Bash(curl * | bash)",
src/skills/configure/references/cc-version-settings.md, line 796"Bash(wget * | sh)"

Show 6 more

src/skills/configure/references/mcp-config.md, line 134"command": "npx",
src/skills/configure/references/mcp-config.md, line 140"args": ["-c", "DIR=\"$CLAUDE_PROJECT_DIR\"; [ -n \"$DIR\" ] || DIR=\"$PWD\"; export MEMORY_FILE_PATH=\"$DIR/.claude/memory/memory.json\"; mkdir -p \"$DIR/.clau
src/skills/configure/references/mcp-config.md, line 145"args": ["-c", "TAVILY_API_KEY=$(op read 'op://<vault>/<item>/<field>') exec npx -y tavily-mcp@latest"],
src/skills/configure/references/mcp-config.md, line 149"command": "npx",
src/skills/configure/references/mcp-config.md, line 194"command": "npx",
src/skills/configure/references/mcp-config.md, line 312| storybook-mcp | Storybook 10.3+ with `@storybook/addon-mcp`. Setup: `npx storybook add @storybook/addon-mcp && npx mcp-add --type http --url "http://localhost

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 7 places.

src/skills/configure/references/operator-scope-settings.md, line 95"denyRead": ["~/.aws/credentials", "~/.ssh", "~/.gnupg", "~/.netrc", "~/.npmrc"]
src/skills/configure/references/operator-scope-settings.md, line 99{ "path": "~/.aws/credentials", "mode": "deny" },
src/skills/configure/references/operator-scope-settings.md, line 100{ "path": "~/.ssh", "mode": "deny" },

Show 4 more

src/skills/configure/references/operator-scope-settings.md, line 101{ "path": "~/.gnupg", "mode": "deny" },
src/skills/configure/references/operator-scope-settings.md, line 102{ "path": "~/.netrc", "mode": "deny" },
src/skills/configure/references/operator-scope-settings.md, line 103{ "path": "~/.npmrc", "mode": "deny" }
src/skills/configure/references/operator-scope-settings.md, line 121are what stop `cat ~/.ssh/id_rsa`. Doctor reports them as two separate findings for

Can call paid AI services billed to you

The author does not mention this.

Found in 1 place.

src/skills/configure/references/operator-scope-settings.md, line 244"api.anthropic.com"

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Other copies in this repository

yonatangross/orchestkit has 1 more folder with a skill named configure. This page shows the lowest-scoring copy.

plugins/ork/skills/configure 49/100 · High risk

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'configure' ] || [ -L ~/.agents/skills/'configure' ]; then echo 'A skill folder named configure already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/yonatangross/orchestkit' "$d" && git -C "$d" checkout --quiet '0d38e66123f2a4a70737bfae758df796070f07df' -- 'src/skills/configure' && mkdir -p ~/.agents/skills && cp -R "$d"/'src/skills/configure' ~/.agents/skills/'configure' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'configure' ~/.claude/skills/'configure' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for yonatangross/orchestkit shows the score of its lowest-scoring skill.

SkillTrust badge for yonatangross/orchestkit

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/yonatangross/orchestkit.svg)](https://zalavijaysinh.github.io/skilltrust/repos/yonatangross/orchestkit/)

Score history

Date	Version	Score
2026-11-10	`0d38e66`	49
2026-11-07	`caa5346`	100