Skill Vetting Tianjin

Vet ClawHub skills for security and utility before installation. Use when considering installing a ClawHub skill, evaluating third-party code, or assessing w...

This skill appears to implement a local scanner and guidance for vetting other skills, but do not install or run it blindly. Before using it: (1) Verify the missing/mentioned files (e.g., mediate.py) or confirm the author intentionally omitted them; (2) Inspect scripts/scan.py locally to confirm it performs only local regex scanning (no network calls, no eval/exec, no subprocess.shell=True); (3) Be aware SKILL.md contains prompt-injection examples that will trip pattern detectors — treat those as test data, not operational instructions; (4) Check the metadata mismatch (ownerId/version) and confirm author identity; (5) Run the scanner in an isolated environment (container or VM) and manually review any CRITICAL findings before taking automated actions. If you need automated deployment, ensure your pipeline distinguishes 'example text' from live code to avoid false auto-rejects.

Type: OpenClaw Skill Name: skill-vetting-tianjin Version: 1.1.1 The skill is a security utility designed to help AI agents vet other ClawHub skills for malicious patterns and utility. It includes a Python-based regex scanner (scripts/scan.py) that identifies dangerous functions (eval, exec, shell=True), obfuscation, and social engineering attempts. While SKILL.md contains instructions regarding prompt injection, these are defensive guidelines intended to harden the agent's review process rather than malicious overrides. The logic is transparent and aligned with its stated purpose.