The recommended installer runs an unpinned npx tool against a mutable remote repository
Source references: 2The recommended command invokes a locally absent, unversioned `skills` npm tool and installs from a GitHub URL. Future changes to the npm package, repository default branch, or dependencies can make the installed content differ from the material reviewed here.
The command may execute installation logic not covered by this audit and place changed files in the agent's Skill directory. A malicious or compromised upstream version could access files and permissions available to the installer process.
The README recommends `npx skills add` and installs directly from a GitHub URL with no pinned commit or release. The command depends on both an npm CLI resolved at execution time and the repository's then-current contents, so a later user may receive code different from the audited files. If either upstream changes or is compromised, installation could affect the skills directory and whatever permissions the installed skill later receives. Users can ask for a pinned CLI version, commit hash, and checksum, or restrict installer file and network access.
### 方法一：通过 npx 一键安装（推荐）```bashnpx skills add https://github.com/op7418/Humanizer-zh.git```这是最简单的安装方式，会自动将技能安装到正确的目录。Show 1 other places
### 验证安装重启 Claude Code 或重新加载 skills 后，在对话中输入：```/humanizer-zh```如果安装成功，该技能将被激活。