# How to read and sandbox a brand new skill before you install it with anatomy

Repo: [wheresryan22/anatomy](https://github.com/wheresryan22/anatomy) | Difficulty: Intermediate | Time: 1 hour | Basis: Seen in the wild

Follow the habit seen in the field of checking a fresh repo's scripts before running an unknown skill.

**Who it is for:** Cautious developer about to install a viral agent skill from a days-old repo

**The problem:** New skills run code with your agent's access, and a trending repo can still hide risky scripts.

**The outcome:** A checked install where you have read the install scripts and hooks and ran it in an isolated environment first.

## Steps

1. Clone or download the repo and read SKILL.md and any install scripts first.
2. Look for auto-run hooks, odd obfuscation or hidden characters in the files.
3. Install in a throwaway project or sandbox: npx skills add wheresryan22/anatomy
4. Only install globally with -g after you are comfortable.

## Prompt to paste into your agent

```text
Review the wheresryan22/anatomy repo for install scripts, auto-run hooks, hidden Unicode and obfuscation, and summarize anything risky before I install it. List the files you checked.
```

## Caveat

A review is only as good as what you read, and the README says the kit uses no npm dependencies, so confirm that yourself.

## Seen in the wild

- X (Oct 2026): https://x.com/i/web/status/2111608344611844268
- X (Oct 2026): https://x.com/i/web/status/2111459791780401180

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/wheresryan22-anatomy/vet-a-new-agent-skill-before-installing/