← Back to Skills Marketplace
416
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install skill-safety-verifier
Description
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Usage Guidance
This tool appears to implement the vetting functions it advertises, but do not run it on sensitive networks or with privileged access until you address the TLS issue. Ask the author why SSL verification is disabled (and prefer a version that keeps certificate verification enabled). Before installing or using: 1) Inspect analyzer.py (the fetch_advisories code) and patch it to enable certificate verification (remove CERT_NONE). 2) Run the analyzer in an isolated environment/container with limited network access. 3) Consider providing a GitHub token for authenticated advisory queries. 4) Review any output the analyzer produces (it writes a cache to ~/.cache/skill-safety/). If you are not comfortable editing code, avoid installing or only run on isolated test hosts.
Capability Analysis
Type: OpenClaw Skill
Name: skill-safety-verifier
Version: 0.1.1
The skill 'skill-safety-verifier' is designed to detect security risks in other skills, which is a benign purpose. However, the `analyzer.py` file contains a critical vulnerability: it disables SSL certificate verification (`ctx.verify_mode = ssl.CERT_NONE`) when fetching vulnerability advisories from `https://api.github.com/advisories`. This makes the skill susceptible to Man-in-the-Middle (MITM) attacks, allowing an attacker to feed false or malicious vulnerability data to the verifier, thereby compromising its integrity. While this is a vulnerability in the skill's own security implementation rather than an act of intentional malice, it is a significant flaw in a security tool, classifying it as 'suspicious'.
Capability Assessment
Purpose & Capability
Name/description align with the code and files: analyzer.py implements code-pattern scanning, dependency vulnerability checks against GitHub Advisory API, permission analysis and a risk scoring renderer. The presence of setup.py, CLI entry point, and documentation is consistent with a local analysis tool.
Instruction Scope
SKILL.md/README describe cloning a target skill and scanning its files and dependencies, which matches analyzer.py's scanning behavior. However there is a notable contradiction: README claims SSL verification is used by default, while analyzer.py explicitly disables SSL certificate verification (ssl.CERT_NONE) when calling the GitHub Advisory API. That weakens the security guarantees of a tool whose purpose is vetting security.
Install Mechanism
Registry has no install spec, but the package includes setup.py and instructions to pip install or wget individual files. The install approach uses standard pip/setuptools and a small requirements.txt (requests). No high-risk download-from-unknown-host patterns are present in the manifest; however README suggests direct wget from raw.githubusercontent.com which is common but should be used carefully.
Credentials
The skill declares no required environment variables or elevated credentials. It writes cache to ~/.cache/skill-safety/ (expected for advisories cache). The tool scans repository files (including SKILL.md, package.json) which is necessary for its purpose and does not request unrelated secrets.
Persistence & Privilege
No always:true, no special OS-level privileges requested. Installing via pip would create a console script and a cache directory — standard for a CLI tool. It does not attempt to modify other skills' configs or request permanent platform privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-safety-verifier - After installation, invoke the skill by name or use
/skill-safety-verifier - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.1
## v0.1.1 Changelog
- Updated documentation in `README.md` for clarity and detail.
- No code or functional changes introduced in this version.
- Content was added and/or reorganized to improve explanation of assessment criteria, risk scoring, workflow, and usage examples.
v0.1.0
Skill Safety Verifier — initial release.
- Provides security-first vetting for AI agent skills before installation.
- Scans for red flags, permission scope, suspicious code patterns, and known vulnerabilities.
- Calculates a unified risk score across network, code quality, and permissions.
- Classifies risk into Safe, Low, Medium, or High with clear recommendations.
- Integrates with GitHub Advisory API for real-time vulnerability data.
- Outputs easy-to-read risk radar and summary to guide user decisions.
Metadata
Frequently Asked Questions
What is Skill Safety Verifier?
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,... It is an AI Agent Skill for Claude Code / OpenClaw, with 416 downloads so far.
How do I install Skill Safety Verifier?
Run "/install skill-safety-verifier" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill Safety Verifier free?
Yes, Skill Safety Verifier is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Skill Safety Verifier support?
Skill Safety Verifier is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill Safety Verifier?
It is built and maintained by ttttstc (@ttttstc); the current version is v0.1.1.
More Skills