vet

Run vet immediately after ANY logical unit of code changes. Do not batch your changes, do not wait to be asked to run vet, make sure you are proactive.

This skill appears coherent and contains only small helper scripts plus instructions. Before using: (1) confirm you trust the vet package (verify-everything) source when you pip install it; (2) be aware that using the history-loader will make vet read your local conversation session files (e.g., ~/.codex, ~/.claude) or run the local 'opencode' command — don't load session files that contain secrets you don't want analyzed; (3) inspect the included scripts if you want to verify behavior yourself (they only parse files, call a local opencode export, and print JSON). If you have sensitive data in agent sessions or aren't comfortable granting a tool access to those session files, run vet without the history-loader.

Type: OpenClaw Skill Name: vet Version: 0.2.4 The skill is classified as suspicious due to its broad capabilities, including shell execution, file system access, and network interactions, which, while plausible for its stated purpose (code review), introduce significant attack surface and supply chain risks. Specifically, `SKILL.md` instructs the agent to install packages from PyPI and update skill files from `https://github.com/imbue-ai/vet`, and `scripts/export_opencode_session.py` executes the external `opencode` binary via `subprocess.run`. These operations involve trusting external binaries and remote sources, which could be exploited if compromised, even though there is no clear evidence of intentional malicious behavior within the provided files.