Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Replace author name with public handle (LeeOde)
What This Skill Does
A reasoning methodology for AI agents to evaluate skills before installation. Covers red/green flag heuristics, a 4-phase audit protocol (reconnaissance, analysis, installation, post-install verification), and common attack pattern recognition. Zero dependencies — no scripts or tools required, just the agent reading and applying the framework.
Pattern-matching scanners catch known threats; this approach trains reasoning about intent and trust so novel attack patterns are detectable without updated signatures.
When to use it
- Vetting an unfamiliar skill before adding it to an agent
- Running post-install checks after a new skill is installed
- Classifying a skill by risk tier to calibrate review depth
- Detecting instruction injection hidden inside SKILL.md content
- Documenting security reasoning for a human collaborator to review
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Vet this skill before I install it: some-new-skill
- 1List all files in the skill using clawhub inspect, noting types, sizes, and structure
- 2Read each file and check for red flags such as shell scripts modifying system files, network calls to unknown endpoints, or obfuscated code
- 3Classify the skill into a risk tier based on file types and contents found
- 4If installed, run post-install verification by checking for new processes, network listeners, crontab changes, and hidden files
- 5Present a structured security assessment with tier, flags found, and a recommendation
Security assessment showing Tier 1 (pure instructions), no red or yellow flags, green flags for markdown-only content and clear documentation, with a safe-to-install recommendation