← Back to Skills Marketplace
81
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install evez-skill-vetter
Description
Security review for OpenClaw skills before installation. Use when evaluating third-party skills for safety, checking permission scope, detecting suspicious p...
README (SKILL.md)
Skill Vetter
Review third-party skills before installing them. Catch security risks early.
Quick Start
python3 scripts/vet.py --skill /path/to/skill
python3 scripts/vet.py --slug some-skill # vet a ClawHub skill
What It Checks
- Permission scope — Does the skill request exec, network, or file access?
- Suspicious patterns — eval(), exec(), subprocess, fetch to unknown hosts, encoded strings
- Data exfiltration — Sending data to external endpoints, logging secrets
- Dependency risks — Known vulnerable packages, excessive dependencies
- Code quality — Minified/obfuscated code, missing SKILL.md, oversized files
- Secret exposure — Hardcoded API keys, tokens, passwords in source
Risk Score
Each check produces a risk score 0-100:
- 0-20: ✅ Safe — install freely
- 21-50: ⚠️ Caution — review findings before installing
- 51-75: 🚨 Risky — significant security concerns
- 76-100: ❌ Dangerous — do not install
Output
SKILL: some-skill
RISK: 35/100 (Caution)
FINDINGS:
⚠️ Uses subprocess.call() in scripts/run.sh:3
⚠️ Fetches from https://unknown-api.com in scripts/pull.py:12
✅ No hardcoded secrets found
✅ SKILL.md present and valid
Usage Guidance
This skill is reasonable to use as a local, user-invoked scanner, but keep its scope narrow and do not rely on its score as a complete security decision. Be aware that the documented --slug workflow appears unimplemented and that the script may need the click Python package to run.
Capability Analysis
Type: OpenClaw Skill
Name: evez-skill-vetter
Version: 1.0.0
The skill is a security auditing tool designed to perform static analysis on other OpenClaw skills. The primary script, scripts/vet.py, uses regex patterns to detect dangerous functions (e.g., eval, subprocess), hardcoded secrets (API keys, AWS tokens), and obfuscation techniques without executing the target code. The SKILL.md file provides clear documentation and lacks any prompt-injection attempts or deceptive instructions, and the code contains no evidence of data exfiltration or malicious intent.
Capability Tags
Capability Assessment
Purpose & Capability
The stated purpose and included code are coherent: it locally scans a user-selected skill directory for risky text patterns. However, the documentation describes broader vetting such as dependency risk checks and a ClawHub slug workflow that the provided script only partially implements.
Instruction Scope
The instructions are user-invoked CLI examples, not automatic execution. The --skill path is user-controlled and scanned recursively, so users should keep it scoped to the skill they intend to review.
Install Mechanism
There is no install spec or remote installer, which is low risk. The script imports the external Python package click, but no dependency declaration is provided, so running it may require a separately installed dependency.
Credentials
Recursive local file reading is proportionate for a static skill vetter and the artifacts show no network transmission, credential use, or persistence. It can still inspect many local files if pointed at a broad directory.
Persistence & Privilege
No background service, persistence mechanism, account privilege use, credential loading, or stored memory behavior is shown in the artifacts.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install evez-skill-vetter - After installation, invoke the skill by name or use
/evez-skill-vetter - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of evez-skill-vetter — security auditing tool for OpenClaw skills.
- Performs static analysis to identify suspicious code patterns and permission requests.
- Checks for data exfiltration risks, secret exposure, and dependency vulnerabilities.
- Audits skill metadata, code quality, and permission scope before installation.
- Assigns a risk score (0–100) with clear safety recommendations.
- Provides detailed, actionable findings for each analyzed skill.
Metadata
Frequently Asked Questions
What is Evez Skill Vetter?
Security review for OpenClaw skills before installation. Use when evaluating third-party skills for safety, checking permission scope, detecting suspicious p... It is an AI Agent Skill for Claude Code / OpenClaw, with 81 downloads so far.
How do I install Evez Skill Vetter?
Run "/install evez-skill-vetter" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Evez Skill Vetter free?
Yes, Evez Skill Vetter is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Evez Skill Vetter support?
Evez Skill Vetter is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Evez Skill Vetter?
It is built and maintained by Evez666 (@evezart); the current version is v1.0.0.
More Skills