Fox Skill Vetter

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...

Security Scan

The skill is an instruction-only vetting checklist whose requested capabilities and instructions match its stated purpose, but there are minor metadata inconsistencies and runtime network/read-all-files guidance you should confirm before trusting automated runs.

Purpose & Capability

The name/description match the content: it's a vetting checklist that asks the agent to review skill files and metadata. It does not request credentials, binaries, or installs, which is proportionate. Minor inconsistency: the provided registry metadata ownerId/slug differ from the _meta.json ownerId/slug (registry shows ownerId 'kn78159cvc1zjyb32x3nchgy6982v9kc' and slug 'fox-skill-vetter', while _meta.json contains ownerId 'kn71j6xbmpwfvx4c6y1ez8cd718081mg' and slug 'skill-vetter'). That mismatch is unexplained and worth verifying with the publisher before trusting the skill.

Instruction Scope

SKILL.md stays within vetting scope: it instructs reading all files of a candidate skill, listing red flags, evaluating permission scope, producing a structured report, and gives example curl commands to query GitHub. These actions are appropriate for a vetter. Note: the examples include network fetches (GitHub API, raw.githubusercontent), so running the vetter implies network access; also the guidance to 'read ALL files' means the agent will inspect any content present, which is expected but sensitive.

Install Mechanism

Instruction-only skill with no install spec and no code files — no code is written to disk by this skill and nothing is installed. This is the lowest-risk install model.

Credentials

The skill declares no required environment variables, no credentials, and no config paths. Its instructions do not request secrets or external tokens. This is proportionate for a vetting checklist.

Persistence & Privilege

always:false and default model invocation settings are used. The skill can be invoked autonomously (the platform default); that is reasonable for a vetter, but you should consider governance controls if you allow it to run without human oversight because it may perform network fetches and full-file inspections when invoked.

Scan Findings in Context

[no_code_files_found] expected: The regex scanner had no code to analyze because this is an instruction-only skill; that is expected for a checklist-style vetter.

Assessment

This skill is internally coherent and appears to do what it says: a checklist for vetting other skills. Before installing or allowing automated runs: (1) verify the publisher/owner identity — the _meta.json ownerId/slug does not match the registry metadata shown here, which could indicate a packaging or copy issue; (2) decide whether you want this vetter to run autonomously — it may perform network fetches (GitHub API/raw.githubusercontent) and read all files of candidate skills, so grant only the minimal runtime permissions you trust; (3) if you rely on its automated report to make install decisions, spot-check its findings manually for high-risk skills; and (4) confirm your platform/network policy for allowing curl/github access to avoid accidental data exposure.

Skill Vetter 🔒

Security-first vetting protocol for AI agent skills. Never install a skill without vetting it first.

When to Use

• Before installing any skill from ClawdHub
• Before running skills from GitHub repos
• When evaluating skills shared by other agents
• Anytime you're asked to install unknown code

Vetting Protocol

Step 1: Source Check

Questions to answer:
- [ ] Where did this skill come from?
- [ ] Is the author known/reputable?
- [ ] How many downloads/stars does it have?
- [ ] When was it last updated?
- [ ] Are there reviews from other agents?

Step 2: Code Review (MANDATORY)

Read ALL files in the skill. Check for these RED FLAGS:

🚨 REJECT IMMEDIATELY IF YOU SEE:
─────────────────────────────────────────
• curl/wget to unknown URLs
• Sends data to external servers
• Requests credentials/tokens/API keys
• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
• Uses base64 decode on anything
• Uses eval() or exec() with external input
• Modifies system files outside workspace
• Installs packages without listing them
• Network calls to IPs instead of domains
• Obfuscated code (compressed, encoded, minified)
• Requests elevated/sudo permissions
• Accesses browser cookies/sessions
• Touches credential files
─────────────────────────────────────────

Step 3: Permission Scope

Evaluate:
- [ ] What files does it need to read?
- [ ] What files does it need to write?
- [ ] What commands does it run?
- [ ] Does it need network access? To where?
- [ ] Is the scope minimal for its stated purpose?

Step 4: Risk Classification

Risk Level	Examples	Action
🟢 LOW	Notes, weather, formatting	Basic review, install OK
🟡 MEDIUM	File ops, browser, APIs	Full code review required
🔴 HIGH	Credentials, trading, system	Human approval required
⛔ EXTREME	Security configs, root access	Do NOT install

Output Format

After vetting, produce this report:

SKILL VETTING REPORT
═══════════════════════════════════════
Skill: [name]
Source: [ClawdHub / GitHub / other]
Author: [username]
Version: [version]
───────────────────────────────────────
METRICS:
• Downloads/Stars: [count]
• Last Updated: [date]
• Files Reviewed: [count]
───────────────────────────────────────
RED FLAGS: [None / List them]

PERMISSIONS NEEDED:
• Files: [list or "None"]
• Network: [list or "None"]  
• Commands: [list or "None"]
───────────────────────────────────────
RISK LEVEL: [🟢 LOW / 🟡 MEDIUM / 🔴 HIGH / ⛔ EXTREME]

VERDICT: [✅ SAFE TO INSTALL / ⚠️ INSTALL WITH CAUTION / ❌ DO NOT INSTALL]

NOTES: [Any observations]
═══════════════════════════════════════

Quick Vet Commands

For GitHub-hosted skills:

# Check repo stats
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'

# List skill files
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

# Fetch and review SKILL.md
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

Trust Hierarchy

1. Official OpenClaw skills → Lower scrutiny (still review)
2. High-star repos (1000+) → Moderate scrutiny
3. Known authors → Moderate scrutiny
4. New/unknown sources → Maximum scrutiny
5. Skills requesting credentials → Human approval always

Remember

• No skill is worth compromising security
• When in doubt, don't install
• Ask your human for high-risk decisions
• Document what you vet for future reference

---

Paranoia is a feature. 🔒🦀