Plain English
What can you add to an AI agent?
Three kinds of thing, and they are genuinely different — mostly in whether installing one runs any code on your machine. If you have landed here from a project page, the short version is below.
A skill
Written instructions your agent reads when it needs them.
A skill is a folder of text. It tells your AI agent how to do a particular job — review a contract, write a changelog, follow your team’s code style — in the agent’s own words rather than as code.
Installing one copies those files into your agent’s skills directory. Nothing runs, nothing starts in the background, and nothing talks to the internet. The agent simply has a new document it can read.
What to check
Because a skill is instructions aimed at your agent, the thing worth checking is whether those instructions try to do something other than the job: tell the agent to ignore its own rules, hide what it is doing, or send your keys somewhere. That is exactly what the scanner looks for.
An MCP server
A small program that gives your agent a new ability.
MCP stands for Model Context Protocol — a standard way for an AI agent to use an outside tool. An MCP server might let your agent read a database, search your files, call an API, or control a browser.
Installing one copies the program onto your machine and adds an entry to your agent’s configuration telling it how to start that program. It runs only when your agent starts it, and only for as long as your agent is using it.
What to check
This is the kind that actually executes code, so it is the one to be most careful with. Worth knowing: what it connects to, what credentials it wants, and whether it can reach the internet. The scan reports what the source does with environment variables, network calls and other programs.
A plugin
A package of commands and behaviour for your agent.
A plugin bundles things together — commands you can call, skills, sometimes MCP servers — in whatever format your agent expects. Think of it as a collection rather than a single capability.
Installing one copies it into your agent’s plugin directory. What happens next depends on what is inside, which is why a plugin is worth reading before you trust it.
What to check
A plugin can contain both instructions and code, so both sets of concerns above apply. Check what it bundles.
How Techandria fits in
Anyone can publish any of these to GitHub, and installing one means running someone else’s code or handing your agent someone else’s instructions. Techandria scans them, and where a person has approved a specific commit, gives you a one-line command that installs that exact commit and checks it against the hash in the evidence before writing anything.
Where nothing has been approved, you get the repository link and the plain git clone command instead. We would rather say “not yet” than pretend.