← Back to Skills Marketplace
903
Downloads
0
Stars
2
Active Installs
2
Versions
Install in OpenClaw
/install skill-vettr
Description
Static analysis security scanner for third-party OpenClaw skills. Detects eval/spawn risks, malicious dependencies, typosquatting, and prompt injection patte...
Usage Guidance
This skill is internally consistent with its stated purpose (static vetting) but carries the normal risks of Node-based analysis tools: npm install can run lifecycle scripts and tree-sitter packages require native/WASM builds. Before installing or running: 1) Run npm install inside an isolated environment (container/VM) or review the package-lock.json and package.json first. 2) Inspect package.json scripts for postinstall/preinstall entries (the test fixture even includes a malicious example). 3) Verify the required external binaries (git, curl, tar, clawhub) are trusted on your PATH before using vet-url or vet-clawhub. 4) Do not enable allowCwd globally unless you run the scanner from a scoped project directory. 5) If you enable autoVet (skill:pre-install hook), be aware it will run automatically on pre-install events — review configuration and allowed roots carefully. Finally, manual review or sandboxed execution is recommended for high-risk or untrusted sources.
Capability Analysis
Type: OpenClaw Skill
Name: skill-vettr
Version: 2.0.3
The OpenClaw skill 'skill-vettr' is a security scanner designed to detect malicious patterns in other skills. While its intent is benign, it exhibits several high-risk capabilities that warrant a 'suspicious' classification. These include the use of external binaries (`git`, `curl`, `tar`, `clawhub`) via `execSafe` (src/utils/exec-safe.ts) to download and extract untrusted remote code for analysis, which, despite robust sanitization and whitelisting, is an inherently risky operation. Furthermore, its own installation process (`npm install`) is explicitly noted in SKILL.md to run dependency lifecycle scripts, posing a potential supply chain vulnerability to the installer. The skill also offers a configuration (`allowCwd`) that, if enabled, significantly broadens its filesystem access (src/utils/sanitise.ts). All clearly malicious code (e.g., `eval('rm -rf /')`, data exfiltration) is confined to `test/fixtures/malicious-skill/`, serving as test cases for the scanner's detection capabilities, not as part of its operational logic.
Capability Assessment
Purpose & Capability
Name/description match code and instructions: this is a JS/TS static analyzer that uses tree-sitter, inspects SKILL.md/package.json, and optionally fetches remote archives via git/curl/tar/clawhub. Required binaries (node, git, curl, tar, clawhub) and the presence of tree-sitter .wasm artifacts are consistent with the stated purpose.
Instruction Scope
SKILL.md instructs users to run npm install and documents vet-url/vet-clawhub behavior. The instructions explicitly warn about npm lifecycle scripts, the need for .wasm files, and the filesystem roots the scanner will accept. The skill accepts paths under configurable roots and can be configured to allow process.cwd(), which is documented as a security trade-off (enable only from a scoped directory). Overall the runtime instructions stay within vetting scope, but they do require executing external helper binaries and installing native/WASM artifacts — both of which increase the attack surface and are called out in the docs.
Install Mechanism
There is no registry-level install spec, but SKILL.md and package.json expect running 'npm install'. This is appropriate for a Node-based AST tool that needs tree-sitter WASM/native builds. npm install (and tree-sitter install scripts) can execute lifecycle scripts — the skill documents this and recommends installing inside a container or using --ignore-scripts (which may break functionality). This is a legitimate but non-trivial install risk that the skill itself documents.
Credentials
The skill requests no environment variables or credentials. Its runtime code reads files within vetted roots and uses ctx.tools for filesystem ops (mkdtemp, readFile, rm). Those capabilities are necessary to download/extract and scan skill archives. The SKILL.md warns about enabling allowCwd (which expands reachable paths) and about trusting external binaries; those warnings align with the permissions requested.
Persistence & Privilege
always:false and normal model invocation are used. The skill can optionally register an autoVet hook (skill:pre-install) if configured; this gives it broader reach to veto installs but is a documented, configurable feature. The skill does not request to persist or modify other skills' settings beyond registering normal hooks/commands.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-vettr - After installation, invoke the skill by name or use
/skill-vettr - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.0.3
v2.0.3 introduces .vettrignore file support, customizable vetting roots, and safer filesystem defaults.
- Added support for .vettrignore files to exclude files/directories from scans using glob patterns.
- Introduced allowCwd config option: by default, only os.tmpdir(), ~/.openclaw, and ~/Downloads are accepted as vetting roots; set allowCwd: true to scan under the current working directory.
- Added startup verification for required .wasm artifacts with descriptive error messages when files are missing after install.
- Added formal install spec to registry metadata declaring npm install command, required .wasm artifacts, and lifecycle script safety notes.
- Updated documentation to explain filesystem scope, configuration, and .vettrignore format and usage.
v2.0.2
- Updated documentation in SKILL.md: added detailed installation instructions, command usage, detection categories, and limitations.
- Clarified install safety notes regarding dependency scripts and use of containers/VMs.
- Listed required external binaries and their usage for each command.
- Added tables describing detection methods and scanner limitations.
Metadata
Frequently Asked Questions
What is Skill Vettr?
Static analysis security scanner for third-party OpenClaw skills. Detects eval/spawn risks, malicious dependencies, typosquatting, and prompt injection patte... It is an AI Agent Skill for Claude Code / OpenClaw, with 903 downloads so far.
How do I install Skill Vettr?
Run "/install skill-vettr" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill Vettr free?
Yes, Skill Vettr is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Skill Vettr support?
Skill Vettr is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill Vettr?
It is built and maintained by Britrik (@britrik); the current version is v2.0.3.
More Skills