← Back to Skills Marketplace
Openclaw Skill Checker
by
Mr-Liu-lang
· GitHub ↗
· v1.0.0
· MIT-0
126
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install openclaw-skill-checker
Description
Security vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification L...
Usage Guidance
This skill appears to be what it claims: a human-/agent-led vetting checklist. Before using it: (1) run its checks in an isolated environment (temp dir, container, or VM) so 'clawhub install' or other client actions cannot execute unreviewed code on your main system; (2) manually verify any remote URLs the tool fetches (GitHub raw content, API endpoints); (3) be cautious that the tool’s quick-commands may invoke external tooling — prefer to fetch archives and inspect them rather than auto-running installers; (4) note a minor metadata inconsistency: registry metadata and _meta.json show different ownerId values — verify the source/author on ClawHub/GitHub before trusting results. Overall this skill is coherent and useful as part of a secure workflow, but don’t let automated vetting replace manual review for high-risk skills.
Capability Analysis
Type: OpenClaw Skill
Name: openclaw-skill-checker
Version: 1.0.0
The 'skill-vetter' bundle is a security-focused protocol designed to help AI agents audit other skills before installation. It provides structured checklists for identifying red flags like credential theft, obfuscated code, and unauthorized network calls in SKILL.md. The included bash commands (using curl and jq) are standard tools for querying the GitHub API and ClawHub to verify source reputation, aligning perfectly with its stated purpose of risk mitigation.
Capability Tags
Capability Assessment
Purpose & Capability
Name, description, and runtime instructions all describe a vetting/checklist tool. Required binaries (curl, jq) are reasonable for the GitHub/HTTP checks shown in the SKILL.md.
Instruction Scope
Instructions focus on inspecting skill files, GitHub metadata, and running read-only commands to fetch/print files. This is appropriate for vetting, but some quick-commands (e.g., 'clawhub install') could invoke installer behavior — the SKILL.md does recommend installing to a temp dir for review, which mitigates risk. Also the vetting checklist mandates reading ALL files in the skill (which is appropriate) but does not instruct reading user home credential files; it flags those as red flags to reject if present.
Install Mechanism
No install specification and no code files are included; it's instruction-only which minimizes disk writes and attack surface.
Credentials
No environment variables, credentials, or config paths are requested. The SKILL.md explicitly treats access to ~/.ssh, ~/.aws, etc. as red flags, which is proportionate for a vetter.
Persistence & Privilege
The skill is not marked always:true and does not request persistent or elevated privileges. It does not instruct modifying other skills or system-wide agent config.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install openclaw-skill-checker - After installation, invoke the skill by name or use
/openclaw-skill-checker - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of skill-vetter — a security vetting protocol for AI agent skills.
- Provides red flag detection for credential theft, code obfuscation, and data exfiltration.
- Implements a multi-step vetting process: source check, code review, permission analysis, and risk classification.
- Outputs structured vetting and risk classification reports (LOW/MEDIUM/HIGH/EXTREME).
- Includes actionable checklists and vetting report templates.
- Never install untrusted skills without running this vetting procedure first.
Metadata
Frequently Asked Questions
What is Openclaw Skill Checker?
Security vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification L... It is an AI Agent Skill for Claude Code / OpenClaw, with 126 downloads so far.
How do I install Openclaw Skill Checker?
Run "/install openclaw-skill-checker" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Openclaw Skill Checker free?
Yes, Openclaw Skill Checker is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Openclaw Skill Checker support?
Openclaw Skill Checker is cross-platform and runs anywhere OpenClaw / Claude Code is available (linux, darwin, win32).
Who created Openclaw Skill Checker?
It is built and maintained by Mr-Liu-lang (@mr-liu-lang); the current version is v1.0.0.
More Skills