Skill Vetter (by Azhua)

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...

Security Scan

An instruction-only vetting checklist that is internally consistent with its stated purpose and does not request extra credentials, installs, or elevated privileges.

Purpose & Capability

Name/description match the content: SKILL.md is a human-readable vetting protocol and quick GitHub commands. No unrelated env vars, binaries, or installs are requested. _meta.json contains price and wallet info (expected for a catalog entry) but does not contradict the purpose.

Instruction Scope

Instructions direct the agent/human to inspect all files in a skill repo, run harmless GitHub API curl commands, and look for clear red flags (network exfiltration, credential access, eval/exec, etc.). This is appropriate for vetting, but 'Read ALL files' requires that the vetting actor only access the skill's repository/workspace — do not conflate this with reading unrelated local/system files (e.g., ~/.ssh).

Install Mechanism

No install spec and no code files — instruction-only. Lowest-risk install posture (nothing written to disk by the skill itself).

Credentials

No required environment variables, credentials, or config paths are declared or used. The SKILL.md does not instruct using any secrets or service tokens.

Persistence & Privilege

always is false and the skill is user-invocable. It does not request persistent presence or system modifications. Autonomous invocation is allowed by default on the platform, but this skill's instructions do not require or create elevated privileges.

Assessment

This skill is a manual vetting checklist and appears coherent and low-risk. Before using it: (1) confirm you're only inspecting the skill's repository/workspace (do not allow the agent to read unrelated local files like ~/.ssh or ~/.aws); (2) verify the author/repo yourself (stars, history, reviews) as recommended by the checklist; (3) treat the wallet/price in _meta.json as a catalog/payment detail, not a capability; (4) remember this is a guide for humans/agents — it cannot automatically prove a skill is safe. If you want automated checks, combine this checklist with sandboxed static analysis tools and human review for high-risk skills.

Skill Vetter 🔒

Security-first vetting protocol for AI agent skills. Never install a skill without vetting it first.

When to Use

• Before installing any skill from ClawdHub
• Before running skills from GitHub repos
• When evaluating skills shared by other agents
• Anytime you're asked to install unknown code

Vetting Protocol

Step 1: Source Check

Questions to answer:
- [ ] Where did this skill come from?
- [ ] Is the author known/reputable?
- [ ] How many downloads/stars does it have?
- [ ] When was it last updated?
- [ ] Are there reviews from other agents?

Step 2: Code Review (MANDATORY)

Read ALL files in the skill. Check for these RED FLAGS:

🚨 REJECT IMMEDIATELY IF YOU SEE:
─────────────────────────────────────────
• curl/wget to unknown URLs
• Sends data to external servers
• Requests credentials/tokens/API keys
• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
• Uses base64 decode on anything
• Uses eval() or exec() with external input
• Modifies system files outside workspace
• Installs packages without listing them
• Network calls to IPs instead of domains
• Obfuscated code (compressed, encoded, minified)
• Requests elevated/sudo permissions
• Accesses browser cookies/sessions
• Touches credential files
─────────────────────────────────────────

Step 3: Permission Scope

Evaluate:
- [ ] What files does it need to read?
- [ ] What files does it need to write?
- [ ] What commands does it run?
- [ ] Does it need network access? To where?
- [ ] Is the scope minimal for its stated purpose?

Step 4: Risk Classification

Risk Level	Examples	Action
🟢 LOW	Notes, weather, formatting	Basic review, install OK
🟡 MEDIUM	File ops, browser, APIs	Full code review required
🔴 HIGH	Credentials, trading, system	Human approval required
⛔ EXTREME	Security configs, root access	Do NOT install

Output Format

After vetting, produce this report:

SKILL VETTING REPORT
═══════════════════════════════════════
Skill: [name]
Source: [ClawdHub / GitHub / other]
Author: [username]
Version: [version]
───────────────────────────────────────
METRICS:
• Downloads/Stars: [count]
• Last Updated: [date]
• Files Reviewed: [count]
───────────────────────────────────────
RED FLAGS: [None / List them]

PERMISSIONS NEEDED:
• Files: [list or "None"]
• Network: [list or "None"]  
• Commands: [list or "None"]
───────────────────────────────────────
RISK LEVEL: [🟢 LOW / 🟡 MEDIUM / 🔴 HIGH / ⛔ EXTREME]

VERDICT: [✅ SAFE TO INSTALL / ⚠️ INSTALL WITH CAUTION / ❌ DO NOT INSTALL]

NOTES: [Any observations]
═══════════════════════════════════════

Quick Vet Commands

For GitHub-hosted skills:

# Check repo stats
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'

# List skill files
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

# Fetch and review SKILL.md
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

Trust Hierarchy

1. Official OpenClaw skills → Lower scrutiny (still review)
2. High-star repos (1000+) → Moderate scrutiny
3. Known authors → Moderate scrutiny
4. New/unknown sources → Maximum scrutiny
5. Skills requesting credentials → Human approval always

Remember

• No skill is worth compromising security
• When in doubt, don't install
• Ask your human for high-risk decisions
• Document what you vet for future reference

---

Paranoia is a feature. 🔒🦀