Privacy policy

Last updated 12 August 2026

Who this covers

This policy applies to the Skill Installer browser extension, the native helper it installs on your computer, and this website at skillinstaller.com. Throughout, “we” means the maintainers of Skill Installer.

What we collect: nothing

We do not operate a server that receives your data, because we do not operate a server at all. There is no analytics package, no crash reporter, no usage tracking, no advertising identifier, and no mechanism by which your browsing, your installed skills, or your identity could reach us. We could not tell you how many people use the extension, because we have no way to count.

What the extension stores on your machine

The extension uses your browser’s local extension storage. This data never leaves your device and is removed when you uninstall the extension:

• Your install targets — the directories you have approved for installs, and any project folders you registered.
• Update bookkeeping — for each installed skill, its source repository, the commit it came from, and the HTTP ETags used to check for updates without re-downloading.
• Your preferences — overwrite policy, update check interval, and which sites you granted permission to scan.
• A GitHub token, only if you add one — an optional personal access token for private repositories, stored in extension storage and sent only to GitHub’s API. Leave it blank and no token exists.
• Detected skills for the current tab — held in session storage and discarded when you navigate away or close the browser.

Network requests the extension makes

Every request goes to a third party you have chosen to interact with, never to us:

• github.com — to read the file listing of a repository directory you are installing from.
• raw.githubusercontent.com and codeload.github.com — to download the skill’s files, pinned to a specific commit.
• api.github.com — only if you have supplied a personal access token, and only for private repositories.
• GitHub’s public commit feeds — on the schedule you choose, to see whether an installed skill has changed. You can set this to off.
• The page you are viewing — on marketplace pages, a same-origin request to resolve a listing you clicked.

GitHub receives these requests and handles them under its own privacy policy, exactly as it would if you had opened the same URLs in a tab yourself.

What the extension reads on pages you visit

To find skills, the extension reads the content of pages in the sites it runs on — looking for links to skill directories and for installation commands. This analysis happens entirely in your browser. Nothing about the pages you visit is transmitted anywhere, stored beyond the current tab session, or retained after you navigate away.

The extension ships with access to a small set of known skill hosts. Anywhere else, it does nothing until you explicitly grant permission for that site or invoke a scan yourself.

The native helper

One-click installs need a small helper program on your computer, because a browser extension cannot write to your filesystem. If you choose to install it:

• Your browser starts it for a single request and it exits immediately — it is never resident, and it does not listen on a network port.
• It accepts messages only from this extension’s pinned identifier.
• It writes only inside the skill directories you approved, all of which live under your home folder, and never marks anything executable.
• It records a small receipt file inside each installed skill folder so the extension knows what it installed and can safely remove it later.
• It sends nothing anywhere. It has no network capability of its own.

Declining the helper costs you the one-click install and nothing else — the extension then produces a command for you to run yourself.

This website

skillinstaller.com is a static site. It sets no cookies, runs no analytics, embeds no third-party scripts or trackers, and loads its fonts from its own domain rather than a font service. There is no form to fill in and no account to create.

The site is hosted on Vercel, which — like any web host — processes standard request information such as your IP address and browser user-agent in order to serve pages and protect against abuse. That processing is governed by Vercel’s privacy policy. We do not receive, query, or retain those logs.

Skills you install are third-party content

Skills are published by other people. When you install one, its files come from the source repository, and anything that skill later does — including any network access it performs once your agent runs it — is outside this extension’s control and outside this policy. This is why the preview showing scripts, tool grants and external URLs is mandatory before an install.

Your data rights

Rights like access, correction, deletion and portability exist to let you act on data an organisation holds about you. We hold none, so there is nothing for us to disclose, correct or delete. The data described above is on your own device and under your control: clear it from the extension’s options, or uninstall the extension to remove it entirely. Running the helper’s uninstall script removes the helper and leaves your installed skills alone.

Children

Skill Installer is a developer tool and is not directed at children under 13. We knowingly collect no information from anyone, of any age.

Changes to this policy

If the extension’s behaviour ever changes in a way that affects this policy — adding analytics, for instance, which we have no plans to do — we will update this page and change the date at the top before that version ships. Material changes will also be noted in the extension’s release notes.

Contact

Questions about this policy can go to contact@skillinstaller.com.

A note on scope