Skill Vetter - Pre-Install Security Review

Security vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification L...

Use this skill's checklist ideas, but do not follow its ClawHub temp-install workflow for untrusted skills unless ClawHub guarantees a non-executing extraction mode. Prefer downloading an inert archive or source snapshot, verify publisher/version/integrity, inspect it in an isolated directory, and only install after review and explicit user approval.

Type: OpenClaw Skill Name: openclaw-skill-vetter Version: 1.0.0 This OpenClaw skill, 'skill-vetter', is designed to help an AI agent perform security vetting of other skills. Its documentation (`SKILL.md`, `README.md`) clearly outlines a protocol for identifying malicious patterns like credential theft, obfuscated code, and data exfiltration in *other* skills. The commands provided for the agent to execute (e.g., `curl` to GitHub APIs for metadata, `clawhub install --dir /tmp/skill-vet` to install skills into a temporary directory for inspection, and `find . -type f -exec cat {} \;` to review their contents) are legitimate actions for a security vetting tool. The 'red flag examples' are explicitly presented as patterns to *detect in other skills*, not as code to be executed by this skill itself. There is no evidence of malicious intent, prompt injection against the agent for harmful purposes, or any high-risk behaviors beyond what is necessary for its stated security purpose.