Every week a new AI tool gets shared with "install this and your work gets 10x faster". Some are excellent. Some are a fresh GitHub repo with a nice logo and no one behind it. You do not need to read code to tell the difference. You need to read the page. Here is the check I would run before a tool touches your files, your email or your accounts. It takes about 15 minutes.

1. Who made it?

Start at the repo owner. Is it a company, a known maintainer, or an account that was created last month? Then check the link. If the tool's website says "GitHub" and the link goes to a different repo than the one you were sent, stop there. Shared links get swapped, and a fake download button is one of the oldest tricks around.

2. When did it last change?

Look at the date of the latest commit and the Releases tab. A tool that has not moved in a year may still work, but when it breaks, nobody is coming. You want a steady rhythm of small fixes, not one big launch followed by silence.

3. Read the README like a contract

Skip the hype at the top. Look for three things: what the tool does, what it needs (an account, an API key, a server, a paid service), and what it asks for permission to touch. If a simple job needs five API keys, ask why. If it wants access to your whole Google Drive when you only need one folder, that is a question for the maintainer, and maybe a reason to pick something else.

4. Check the license

The License file tells you whether you can use the tool at work or only for personal experiments. If there is no license at all, do not assume you are allowed to use it commercially. Most people skip this step and only find out when a client asks.

5. Open the Issues tab

Look at a few open issues and a few closed ones. Are people reporting real problems? Does the maintainer reply? A dozen unanswered reports about lost data is an answer, even if you cannot read the code behind them.

6. Test on a dummy first

Before you point the tool at real work, give it a copy: a sample document, a test folder, a throwaway account. Watch what it creates, what it deletes and what it sends out. Keep the first run small and boring.

The short version

If you can answer three questions, who made it, is it still maintained, and what does it touch, you are ahead of most people installing tools this week. You do not have to understand the code to protect your files. You only have to slow down for fifteen minutes before you hit install.

Devesh Sarkaar is the founder of Aivesh Academy and Gharleads, and runs Propvance IT Solutions in Indore. More at deveshsarkaar.com.