Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
A structured vetting protocol for AI agent skills before installation. Scans for red flags like credential harvesting, obfuscated code, and unauthorized network calls. Produces a risk classification and a formatted report with a clear install verdict.
Replaces ad-hoc manual inspection with a repeatable checklist that catches common attack patterns and forces explicit risk classification before any code runs.
When to use it
- Reviewing a ClawdHub skill before adding it to an agent
- Auditing a GitHub-hosted skill shared by another agent
- Checking whether a skill requests more permissions than its stated purpose requires
- Evaluating skills from unknown or low-reputation authors
- Producing a documented vetting record for team review before a high-risk install
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Vet this skill from GitHub before I install it
- 1Fetch repo metadata to check stars, forks, and last updated date
- 2Read all files in the skill directory, starting with SKILL.md
- 3Scan code for red flags: external curl calls, credential file access, base64 decode, eval with external input
- 4Evaluate permission scope against the skill's stated purpose
- 5Classify risk level as LOW, MEDIUM, HIGH, or EXTREME
SKILL VETTING REPORT with red flags listed, permissions catalogued, risk level assigned, and a SAFE TO INSTALL or DO NOT INSTALL verdict