Xiaopi Skill Vetter

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...

This skill is essentially a human-readable vetting checklist and is coherent with its stated purpose, but treat it as guidance rather than an automated authority. Before installing or letting an agent run this vetter autonomously: 1) Verify provenance — the package metadata shows inconsistent owner IDs and no homepage; prefer skills with clear authorship. 2) Run any vetting actions in a sandbox or ephemeral VM so curl/raw file fetches can't cause harm. 3) Limit the agent's file-read scope to the skill package directory (do not let it read your home, ~/.ssh, ~/.aws, or other sensitive paths). 4) Manually confirm that the agent does not automatically transmit any collected data to external endpoints. 5) Treat the output of this skill as advisory and perform a human code review for high-risk skills. If you need higher assurance, ask for the publisher's identity or a signed release before trusting automated vetting.

Type: OpenClaw Skill Name: xiaopi-skill-vetter Version: 1.0.0 The skill is a security utility designed to help AI agents vet other skills before installation. It provides a structured protocol, red flag checklists, and risk assessment levels in SKILL.md. The included shell commands are limited to fetching metadata and file contents from the GitHub API for review purposes, and no malicious intent or high-risk behaviors were identified.