Free to read · no account needed

10 min · plugins

Install and evaluate a plugin

Goal: Rewrite permissions in plain words and grade them before install; uninstall if the mini-task fails or send scope will not shrink.

Best for: first time installing GPT actions, Claude connectors, or marketplace plugins.

“Plugin” here means an add-on that lets the model talk to an outside app (mail, calendar, docs, code host). Names differ by product; the checklist is the same. Install is not success—evaluation is. Give each plugin a 10-minute job and a kill criterion before you keep it. Pair with directory hygiene and least privilege.

Before you click Allow: who made it, what it can read/write, whether you can revoke it, and one tiny read-only test task.

Why beginners skip this

Installing a plugin without evaluation feels fast—permissions and side effects show up only as accidents. Run the eval list first.

Step 1 — Read permissions like a label

Open the plugin/connector page, list permissions, then rewrite them in your own words—no marketing nouns.

Permissions text:
[paste]
Rewrite in plain words: what it can read · write · send.
Rate risk low/med/high for a beginner and why.
Example

Filled prompt

Plugin wants calendar write day one; last update 11 months ago.
Trust score + wait/avoid. Eval would be read-only list events—if ever install.

What good output looks like

  • Separates read vs write vs send
  • High risk if write/send not needed
  • Suggests seeking read-only scope first

Step 2 — Tiny evaluation task

Before real work, run a read-only mini-task, e.g. “List the next 3 calendar events; change nothing.”

Propose a 5-minute read-only eval task for plugin: [name]
Include: exact prompt · what success looks like · how to revoke if weird.
Example

Filled prompt

Candidate plugin: "SuperMail Boost" can send replies; publisher Discord-only; last update 2024.
Score trust 1–5. Eval task if wait: label 3 threads read-only. Recommend install/wait/avoid.

What good output looks like

  • Eval score written before install for “add a plugin or connector only after a short safet”
  • Uninstall path and scopes listed
  • No always-allow on write/send
  • Pass/fail: keep-or-remove decision dated

Step 3 — Keep or uninstall

Uninstall if the mini-task fails or it carries write scopes you do not need—“install was annoying” is not a keep reason.

Decision memo (6 lines): keep or uninstall [plugin] after this eval result: [paste].
Example

Filled prompt

Eval showed it drafted a send without asking. Decision memo.
Context: live job for plugins-install-and-evaluate — “add a plugin or connector only after a short .” Keep never-invent / draft-only.

What good output looks like

  • Uninstall path and scopes listed
  • No always-allow on write/send
  • Pass/fail: keep-or-remove decision dated
  • Eval score written before install for “add a plugin or connector only after a short safet”

Eval or uninstall today

Ten minutes with a real task. Keep or remove—no maybe-later pile.

Do not bookmark-only

Finish Practice now, then tick this guide on your path. Titles unread are not skills.

Close the loop

Write one line: next time I install with no eval, I refuse.

Red flag

Keeping after a failed mini-task; vague permissions accepted—uninstall.

Save this card

Card: Keep only after a read-only mini-task passes; uninstall on failure or vague permissions. Keep this beside the tool; read before you start.

Before you start

Open the listing and a notes doc. Score purpose/scopes/uninstall for “add a plugin or connector only after a short” before Install. Prefer wait over Always allow. Guide: plugins-install-and-evaluate. Keep the real job visible the whole time; a blank box means stop and fetch the artifact first.

How to use this week

This week before installing a real plugin run the eval list: permissions, data egress, uninstall path; no install if it fails.

Close the week by quoting aloud the refuse line you actually used once. If you cannot, rerun Practice now and date the pass/fail (Asia/Shanghai).

Pitfalls

PitfallFix
Allow all on install dayStart with minimal scopes
Skipping the tiny testAlways run one read-only eval
Leaving unused plugins connectedMonthly cleanup (hygiene)
Keeping because install was hardEval failure → uninstall
Example

Filled prompt

Temptation: skip the habit for plugins-install-and-evaluate to save five minutes.
Job still: add a plugin or connector only after a
Smallest correct pass: Done visible · checkable artifact · Unknowns [?].
Boundaries: draft only; no silent send; no invented metrics.
Return: artifact + refuse-line said aloud.

What good output looks like

  • Names the shortcut refused (specific to plugins-install-and-evaluate)
  • Still delivers checkable output for “Install and evaluate a plugin”
  • Unknowns labeled; draft-only
  • Pass/fail: refuse-line dated (plugins-install-and-evaluate #4)

Practice now

Community pulse: check last commit/update date (Asia/Shanghai).

Rollback note: how to uninstall in ≤3 steps (Asia/Shanghai).

Scorecard: need/maintainers/perms scored 1–5 before install (Asia/Shanghai).

Uninstall path: write uninstall/revoke steps before install (Asia/Shanghai).

Perm-read drill: read permission prompt aloud before Accept (Asia/Shanghai).

Plugin-eval drill: score one plugin on need / maintainers / permissions before install (Asia/Shanghai).

Thin-spot drill: rewrite the Save card with real nouns from your work (repo, doc, inbox). Generic placeholders fail the drill.

Tonight before installing a real plugin run the eval list: permissions, data egress, uninstall path; no install if it fails.

Reality check: after Practice now, write one sentence you will refuse next time—and keep it on the Save card dated Asia/Shanghai.

Today card (copy) — plugins-install-and-evaluate: 1. Artifact I will produce: ___ 2. Pass/fail check: ___ 3. Refuse-line if tempted to skip verify/send: ___ (date: Asia/Shanghai) 4. One never-do from this guide: ___

Extra pass: do the card on a real file today—reading alone does not count.

One sentence takeaway

Eval list: permissions, data egress, uninstall path; no install if it fails.

Word-floor practice

Run the Today card once on a real artifact. Write pass/fail + never-do with date Asia/Shanghai. If you only skimmed, do not mark this guide done.

Next

Build vs install · Least privilege · Directory hygiene

← Back to home · Learn · Tools · Compare · Start