Vivi Skill Vetter

Security-first skill vetting for AI agents. Use BEFORE installing any skill from ClawHub, GitHub, or other sources. Checks for red flags, dangerous patterns,...

This skill looks coherent and appropriate for vetting other skills, but take these precautions before use: 1) Inspect scripts/vet_skill.py yourself (or review with someone you trust) — a vetter must be trusted. 2) Run scans on cloned repos in a sandbox or ephemeral container (not as root) to avoid accidental execution of malicious install scripts. 3) Remember the vetter detects patterns but is not perfect — manual review of flagged items is required and the absence of flags is not a guarantee. 4) Do not run installers (curl | bash, installers, or scripts found in the scanned repo) without manual inspection and verification. 5) If you plan to automate this vetter, pin a specific vetted version and monitor updates/changes to the vetter itself.

Type: OpenClaw Skill Name: vivi-skill-vetter Version: 1.0.0 The skill bundle is a security utility designed to perform static analysis and vetting of other OpenClaw skills. The core logic in 'scripts/vet_skill.py' implements a regex-based scanner to detect dangerous patterns such as RCE, privilege escalation, and data exfiltration. While the script contains numerous high-risk strings (e.g., 'rm -rf /', 'curl | bash'), they are used exclusively as detection signatures and are not executed. The documentation in 'SKILL.md' and 'references/patterns.md' provides legitimate security guidance and a 'Three-Zone Security Boundary' framework to help the agent protect the user's environment.