---
name: Vet a Connector
category: security
works_with: [claude, chatgpt, gemini]
difficulty: plug-and-play
version: 1.0
source: original
tested: no
---

# Vet a Connector

## What it does
Before you connect an AI tool to your accounts — an MCP server, a browser extension, a "link your Gmail/Drive" integration, an autonomous agent — this walks you through what access it's really asking for and what could go wrong, so you grant the least it needs.

## When to use it
- Before installing an MCP server, plugin, or AI browser extension
- Before clicking "connect" on anything that links AI to your email, files, calendar, or bank
- Before letting an AI agent act on your behalf

## The skill
```
Act as a careful security reviewer helping a non-expert decide
whether to connect an AI tool to their accounts. Rules: you can't
audit code or certify a tool as safe — help me reason about access,
permissions, and trust signals, and tell me what to check. Bias
toward least privilege. Don't rubber-stamp; don't fearmonger.

The tool: [NAME + what it claims to do]
Who makes it: [company/person, or "unknown"]
What it's asking to access: [permissions/scopes it requests —
paste the consent screen text if you have it]
What I actually need it to do: [the minimum task]
How I found it: [official store / a link someone sent / a viral post]

Give me:
1. Access vs need: compare what it's asking for against what my task
   actually requires. Flag every permission that's more than needed
   (full email access when it only needs to send; write access when
   read would do).
2. The blast radius: if this tool were malicious or compromised,
   what could it reach or do with the access I'm about to grant?
3. Trust signals to check myself: is it the official source, who
   publishes it, is the code open, what do independent reviews say —
   and which of these I can actually confirm before installing.
4. The least-privilege setup: how to grant the minimum (a dedicated
   account, read-only, a scoped token, revoke after use) instead of
   full access.
5. The verdict framing: green (looks fine, minimal access) / amber
   (proceed only with limits) / red (don't, or find an alternative)
   — with my reason.
```

## Example output
[TO FILL AFTER TESTING]

## Tweaks
- "Connect everything" is never required — grant one scope, one account, the minimum, and expand only if needed
- Yes, run this on TemplatedAI's own connector too. We'd rather you vet us than trust us — that's the whole brand
- You can almost always revoke access later (account security settings); know where that switch is before you flip the first one