Skill Vetter

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...

This is primarily a human-readable checklist (instruction-only) and is internally coherent for the stated purpose. Before installing or trusting it: 1) Verify the skill's provenance — the registry metadata and the included _meta.json/SKILL.md disagree on owner and version, and no homepage/repo is listed. That could be a simple packaging mistake but treat it cautiously. 2) Remember this skill only provides vetting guidance; it does not itself perform code analysis or run tools. If you allow an agent to run this skill autonomously, the agent will be instructed to read all files of the target skill — ensure you only permit that on skills you intend to inspect. 3) Prefer vetters with a verifiable repository or homepage and matching metadata. If unsure, run the checklist manually (or ask a human) rather than granting the agent broad autonomous permissions.

Type: OpenClaw Skill Name: xiaoding-skill-vetter Version: 1.0.3 The skill-vetter bundle is a security-focused tool designed to guide an AI agent through a vetting process for other skills. It provides a structured protocol for identifying red flags (such as credential theft or unauthorized network calls) and includes standard bash commands in SKILL.md for inspecting GitHub repository metadata and file contents. No malicious logic, obfuscation, or exfiltration attempts were found.