Security and trust
Stream Agent Skills are markdown instructions: installing them executes nothing. One skill, stream-feeds-migration, ships a small Python script (standard library only, read-only against your app) that your agent runs only when you ask for a Feeds migration mapping. Network operations happen at four points: the getstream CLI you install yourself, on-demand skill fetches the router runs (silent for most packs; the Flutter pack asks first), the installs a build performs (scaffolding, and the verification tooling below), and optional installs the agent asks about before running.
Everything across the lifecycle that can reach the network, and when:
flowchart TD
I["Install CLI: curl getstream.io/cli.sh | bash"] --> INIT["getstream init<br/>auth · pick app · offers skills"]
INIT -->|writes skill files| OK["Installing executes nothing"]
OK --> A["Router needs a pack it doesn't have"]
OK --> B["/stream-builder needs UI scaffolding"]
A -->|"getstream skills <name>"| FETCH["Fetch skill markdown<br/>most packs silent · Flutter asks"]
B -->|"lists them, waits"| FE["Optional frontend skills"]
style I fill:#e1f3ff
style INIT fill:#e1f3ff
style OK fill:#e1ffe4
style FETCH fill:#fff3e1
style FE fill:#fff3e1
The getstream CLI
You install the getstream CLI yourself (see Install for the command). The skills never run the installer for you. If it's missing when a task needs it, the skill stops and asks. Everything it does after that runs on your machine, under your account.
The CLI covers the same operations as the Stream Dashboard, from the terminal, so the agent reaches for it rather than an MCP server or ad-hoc API calls.
Install time (skills)
The skills land via getstream init / getstream skills: downloaded into a shared cache at ~/.stream/skills and linked into the project's skills directory. Installing executes nothing. The pack is instruction and data files with one executable exception you can audit in a minute: stream-feeds-migration ships scripts/fetch_sample.py, a standard-library-only Python script that reads a sample of your Feeds v2 data (two read-only endpoints, credentials from environment variables) and writes one local JSON file. It runs only when you ask that skill for a migration mapping, never at install time.
On-demand skill fetches
The router installs a pack the first time a task needs one that isn't present, using getstream skills <name>. The web pack (stream-react), the platform packs for Swift, Android, React Native, Unreal and Unity, and the Feeds migration pack install silently, without a prompt; the Flutter pack asks for one confirmation first. Each fetch pulls the skill files from GetStream/agent-skills.
Build-time tooling
Building and verifying an app installs things the way any development session does. Scaffolding runs npx / npm. When a web build needs to verify a design visually and no browser tooling is present, the pack can install Playwright (published by Microsoft) into a project-local directory, with its ~120 MB Chromium build in the user's shared Playwright cache. The React Native pack's verification flow uses developer tools you'd expect for that platform (CocoaPods and the iOS simulator) and can offer brew install watchman. Each pack announces its plan up front and treats your request to build as consent; none of this runs at skill-install time.
Frontend skills
Only /stream-builder triggers this step, and only when it needs UI scaffolding. It offers to pull three open-source frontend skills from vercel-labs/agent-skills and anthropics/skills, listing them and waiting for your approval before installing anything. If you decline, the build still works fine without them. /stream-react never installs these itself; it only uses them if they're already present in the session.
Credentials
Credentials are owned by the getstream CLI. It writes your API key (and, for server targets, your secret) into the project's env file, and they never enter the agent's prompt context.
getstream init stores the project credentials it manages in the project's .stream/ directory and adds .stream/ to the repo's .gitignore automatically, so they are never committed.
The rules every skill follows forbid reading, logging, or echoing secrets on any code path: the skills never cat or grep a .env, and the server secret never reaches the client bundle.