← Back to Skills Marketplace
26313
Downloads
27
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install openclaw-skill-vetter
Description
Security vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification L...
Usage Guidance
Use this skill's checklist ideas, but do not follow its ClawHub temp-install workflow for untrusted skills unless ClawHub guarantees a non-executing extraction mode. Prefer downloading an inert archive or source snapshot, verify publisher/version/integrity, inspect it in an isolated directory, and only install after review and explicit user approval.
Capability Analysis
Type: OpenClaw Skill
Name: openclaw-skill-vetter
Version: 1.0.0
This OpenClaw skill, 'skill-vetter', is designed to help an AI agent perform security vetting of other skills. Its documentation (`SKILL.md`, `README.md`) clearly outlines a protocol for identifying malicious patterns like credential theft, obfuscated code, and data exfiltration in *other* skills. The commands provided for the agent to execute (e.g., `curl` to GitHub APIs for metadata, `clawhub install --dir /tmp/skill-vet` to install skills into a temporary directory for inspection, and `find . -type f -exec cat {} \;` to review their contents) are legitimate actions for a security vetting tool. The 'red flag examples' are explicitly presented as patterns to *detect in other skills*, not as code to be executed by this skill itself. There is no evidence of malicious intent, prompt injection against the agent for harmful purposes, or any high-risk behaviors beyond what is necessary for its stated security purpose.
Capability Assessment
Credentials
The declared `curl` and `jq` requirements and GitHub API examples are proportionate for source reputation checks. Network use is disclosed and appears directed at metadata or source retrieval, not hidden data transmission.
Install Mechanism
The artifact repeatedly recommends installing an untrusted ClawHub skill into `/tmp` for vetting before reviewing files. A temporary destination reduces placement risk but does not prove the installer cannot run code or write elsewhere.
Instruction Scope
Most instructions are scoped to reviewing candidate skill files and producing a report, but the documented temp-install workflow is under-scoped because it does not establish that installation is inert, sandboxed, or free of lifecycle hooks.
Persistence & Privilege
No artifact-backed persistence, sudo execution, credential access, or background service installation by this skill was found. Mentions of sudo, SSH keys, browser sessions, and credential files appear in red-flag examples and rejection criteria.
Purpose & Capability
The stated purpose is coherent: vet skills for credential theft, exfiltration, obfuscation, permissions, and source trust. The concern is that the ClawHub workflow uses `clawhub install` as the acquisition step before review, which may execute installer behavior before the vetting happens.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install openclaw-skill-vetter - After installation, invoke the skill by name or use
/openclaw-skill-vetter - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of skill-vetter: protocol for securely vetting AI agent skills before installation.
- Introduces structured security vetting process, including source verification, code review checklist, and permissions analysis.
- Detects red flags such as credential theft patterns, obfuscated/minified code, data exfiltration, and risky system or network behaviors.
- Classifies risk level as LOW, MEDIUM, HIGH, or EXTREME and produces detailed, markdown-friendly vetting reports.
- Includes practical vetting checklists, report templates, and quick audit commands for both ClawHub and GitHub skills.
- Strongly discourages installing unvetted or sketchy skills; emphasizes rigorous pre-installation checks.
Metadata
Frequently Asked Questions
What is Skill Vetter - Pre-Install Security Review?
Security vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification L... It is an AI Agent Skill for Claude Code / OpenClaw, with 26313 downloads so far.
How do I install Skill Vetter - Pre-Install Security Review?
Run "/install openclaw-skill-vetter" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill Vetter - Pre-Install Security Review free?
Yes, Skill Vetter - Pre-Install Security Review is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Skill Vetter - Pre-Install Security Review support?
Skill Vetter - Pre-Install Security Review is cross-platform and runs anywhere OpenClaw / Claude Code is available (linux, darwin, win32).
Who created Skill Vetter - Pre-Install Security Review?
It is built and maintained by dp-del (@donovanpankratz-del); the current version is v1.0.0.
More Skills