Skill Vet

在安装或运行 skill 前进行安全扫描，检查恶意代码、可疑命令和网络请求等潜在威胁。

This skill appears to implement a local static scanner and does not exfiltrate data or call external endpoints, but there are practical inconsistencies to resolve before use: - Runtime: vetting.cjs is a Node script. Ensure the agent/runtime has Node available and clarify how to invoke it (the SKILL.md uses the 'skill-vet' CLI name but no install/installation steps are provided). - Scope of scans: The tool reads files under whatever path you give it. Do not run it pointed at directories containing secrets you don't want read, unless you trust the environment. - False positives: Many flagged patterns (Buffer.from, fs.writeFile, console.log, process.env access) can be benign; review findings manually. - Minor bug: the script references colors.gray which is undefined — this is cosmetic but indicates the code wasn't thoroughly tested. If you plan to install or run this skill, ask the publisher for explicit installation instructions (how to install the 'skill-vet' CLI or how OpenClaw will invoke vetting.cjs) and confirm that Node will be available. Otherwise the code itself looks coherent with its stated purpose and not malicious.

Type: OpenClaw Skill Name: skill-vet Version: 1.0.0 The skill is a security utility designed to perform static analysis on other skill bundles to identify high-risk patterns such as dynamic code execution, shell injection, and sensitive environment variable access. The implementation in `vetting.cjs` is transparent, uses only built-in Node.js modules (fs, path), and contains no evidence of data exfiltration, malicious execution, or prompt injection.