Security checklist for importing external AI agent definitions safely

Developers using AI coding tools like Claude Code or Codex often import external agent definition files from public collections without fully vetting them, which poses security and compatibility risks. Security-focused guidance recommends treating every external agent file as untrusted input, reading it in full rather than relying on its README before deployment. Reviewers should verify what the file claims to read, write, and execute against what the host environment actually permits, and stage files in a read-only location before placing them in any auto-watched directory. Changes should be minimal and categorised as either mechanical formatting fixes or deliberate meaning-altering decisions, each requiring a stated reason and an owner. Adopting an agent should also be contingent on clearly defining the specific gap it fills — compressed to a single sentence covering input, expected output, and explicit restrictions — before any file is added to a live agents directory.