← 返回 Skills 市场
545
总下载
0
收藏
11
当前安装
1
版本数
在 OpenClaw 中安装
/install skill-vetter-1
功能描述
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
安全使用建议
This skill is coherent and appears safe to use as a checklist. Before relying on it: (1) Verify the skill's provenance — the ownerId in the included _meta.json does not match the registry Owner ID provided to you; confirm which is authoritative. (2) Ensure your agent's file read scope is limited to the skill repository/workspace so 'read all files' cannot access unrelated private data (SSH keys, AWS creds, etc.). (3) If you allow the skill to run network queries, prefer read-only API calls and inspect the exact curl endpoints it will call. (4) Use this vetter as an aid, not a substitute for human review on high-risk skills.
功能分析
Type: OpenClaw Skill
Name: skill-vetter-1
Version: 1.0.0
The 'skill-vetter' skill is a defensive security tool designed to guide AI agents through a vetting protocol before installing other skills. It provides a structured framework for identifying red flags such as data exfiltration, credential theft, and obfuscated code in SKILL.md. The included bash commands are limited to fetching repository metadata and file lists from the GitHub API for analysis purposes, and the overall logic promotes a 'security-first' approach with human oversight for high-risk actions.
能力评估
Purpose & Capability
The skill's name, description, and SKILL.md all describe a vetting checklist and the instructions align with that purpose. It is instruction-only and does not request binaries, env vars, or installs. Note: the registry metadata Owner ID (kn78...) differs from the _meta.json ownerId (kn71...), which is a provenance inconsistency worth verifying.
Instruction Scope
The SKILL.md explicitly instructs the agent to 'Read ALL files in the skill' and to run network queries (curl to GitHub APIs) to gather repo info. Those actions are appropriate for a vetting skill, but they require the agent to have file and network access limited to the target repo/workspace; if the agent's file read scope is broader, these instructions could cause wider data exposure. The instructions themselves do not ask the agent to exfiltrate data or access unrelated credentials.
Install Mechanism
No install spec and no code files are present (instruction-only). This minimizes risk from arbitrary downloads or disk writes.
Credentials
The skill declares no environment variables, credentials, or config paths. The SKILL.md advises rejecting skills that request credentials or access to credential files, which is consistent with a security-focused vetter.
Persistence & Privilege
always is false and the skill does not request persistent presence or modification of other skills or global agent settings. Autonomous invocation is allowed (platform default) but not excessive for this use case.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-vetter-1 - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-vetter-1触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of Skill Vetter: a security-first vetting guide for AI agent skills.
- Outlines a step-by-step protocol to check source, code, permissions, and risk level before installing any skill.
- Lists clear red flags to reject (e.g., credential access, suspicious network calls, use of eval/exec).
- Provides a detailed vetting report template for consistent reviews.
- Includes practical commands for vetting GitHub-hosted skills.
- Highlights trust hierarchy and best practices for skill installation security.
元数据
常见问题
Skill Vetter 1 是什么？
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 545 次。
如何安装 Skill Vetter 1？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-vetter-1」即可一键安装，无需额外配置。
Skill Vetter 1 是免费的吗？
是的，Skill Vetter 1 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Skill Vetter 1 支持哪些平台？
Skill Vetter 1 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill Vetter 1？
由 h-harry（@h-harry）开发并维护，当前版本 v1.0.0。
推荐 Skills