Testskill

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...

This skill is a coherent, instruction-only 'vetter' and appears to do what it says: guide an agent/human through reviewing other skills. Before you rely on it, remember: (1) it tells the agent to read files and run curl against GitHub — ensure the agent is sandboxed and has only the minimal permissions needed; (2) it does not supply automated deep-detection: it cannot guarantee detection of obfuscated binaries or hidden native installers — manual review and runtime sandboxing are still necessary; (3) if you or your agent run the GitHub API commands with authentication, that will use your tokens/credentials — the skill doesn't require them but could operate using them if available, so limit token scopes; (4) follow its own advice: check install scripts, network endpoints, and any requests for credentials before installing a skill. Overall this skill is useful and proportionate, but it's an advisory tool — not a substitute for careful manual review and sandbox testing.

Type: OpenClaw Skill Name: skill-vetter-liomi Version: 1.0.0 The skill-vetter bundle is a security-focused instruction set (SKILL.md) designed to guide an AI agent through a vetting protocol for other skills. It includes a comprehensive checklist of red flags, risk levels, and reporting templates. The provided shell commands are limited to fetching metadata and file contents from GitHub for analysis purposes and do not involve executing untrusted code.