Content policy
Last updated:
A kit runs commands on the machine of whoever installs it, and it gives instructions to their coding agent. That's why these rules are strict.
Not allowed
- Malware, backdoors, crypto miners, or commands that do something other than what the kit describes.
- Collecting or sending credentials, environment variables, source code or personal data.
- Skills, MCP servers or AGENTS.md rules that tell the agent to skip the user's confirmation, disable safeguards or act against the user's interests.
- Impersonating another person, company or project, or using their brand to mislead.
- Illegal content, or content that infringes licenses, copyrights, trademarks or other third-party rights.
- Hateful, harassing or sexually explicit content.
- Spam: empty or duplicate kits, or kits created only to promote links.
Expected
- The kit's title and description say honestly what it installs.
- Commands are visible in the kit's manifest, not downloaded and run from hidden sources.
- Skills and libraries come from their official sources.
Reporting and enforcement
Anyone can report a kit from its page, without an account. Reports are reviewed by an admin, who can hide the kit: it stops appearing on first-commit and can no longer be installed from the registry. Serious or repeated violations lead to account suspension. Kits that put users at risk are hidden as soon as the report is confirmed.
To appeal a decision, or to report something urgent, write to chavianomarlon@gmail.com or use the contact page.