Skill Vettr

Static analysis security scanner for third-party OpenClaw skills. Detects eval/spawn risks, malicious dependencies, typosquatting, and prompt injection patte...

This skill is internally consistent with its stated purpose (static vetting) but carries the normal risks of Node-based analysis tools: npm install can run lifecycle scripts and tree-sitter packages require native/WASM builds. Before installing or running: 1) Run npm install inside an isolated environment (container/VM) or review the package-lock.json and package.json first. 2) Inspect package.json scripts for postinstall/preinstall entries (the test fixture even includes a malicious example). 3) Verify the required external binaries (git, curl, tar, clawhub) are trusted on your PATH before using vet-url or vet-clawhub. 4) Do not enable allowCwd globally unless you run the scanner from a scoped project directory. 5) If you enable autoVet (skill:pre-install hook), be aware it will run automatically on pre-install events — review configuration and allowed roots carefully. Finally, manual review or sandboxed execution is recommended for high-risk or untrusted sources.

Type: OpenClaw Skill Name: skill-vettr Version: 2.0.3 The OpenClaw skill 'skill-vettr' is a security scanner designed to detect malicious patterns in other skills. While its intent is benign, it exhibits several high-risk capabilities that warrant a 'suspicious' classification. These include the use of external binaries (`git`, `curl`, `tar`, `clawhub`) via `execSafe` (src/utils/exec-safe.ts) to download and extract untrusted remote code for analysis, which, despite robust sanitization and whitelisting, is an inherently risky operation. Furthermore, its own installation process (`npm install`) is explicitly noted in SKILL.md to run dependency lifecycle scripts, posing a potential supply chain vulnerability to the installer. The skill also offers a configuration (`allowCwd`) that, if enabled, significantly broadens its filesystem access (src/utils/sanitise.ts). All clearly malicious code (e.g., `eval('rm -rf /')`, data exfiltration) is confined to `test/fixtures/malicious-skill/`, serving as test cases for the scanner's detection capabilities, not as part of its operational logic.