A security-first vetting protocol designed to audit and verify the safety of AI agent skills before installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install chen-skill-vetter
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install chen-skill-vetter using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Vetter?
The Skill Vetter is a critical security layer for the Openclaw Skills ecosystem. It provides a standardized framework for AI agents and developers to evaluate the safety, permission scope, and code integrity of third-party skills before they are added to a production environment. By enforcing a rigorous vetting protocol, it mitigates risks such as data exfiltration, unauthorized credential access, and malicious code execution.
This skill transforms security from a manual afterthought into a native part of the agent workflow. It focuses on identifying red flags—such as obfuscated code or suspicious network calls—ensuring that every addition to an agent's toolkit is verified against a strict trust hierarchy. In the world of autonomous agents, this protocol acts as a mandatory firewall for third-party integrations.
Skill Vetter Use Cases
- Evaluating new Openclaw Skills sourced from ClawdHub or GitHub repositories.
- Automated code review of skills shared between agents in a multi-agent system.
- Risk assessment for skills requesting sensitive permissions or API access.
- Periodic auditing of installed skills to ensure compliance with updated security standards.
How Skill Vetter Works
- Source Verification: The agent checks the origin of the skill, author reputation, and community metrics like download counts or stars.
- Code Audit: A mandatory scan of all skill files is performed to detect high-risk patterns like base64 decoding, external network calls to raw IPs, or access to sensitive local files.
- Permission Mapping: The skill's required read/write permissions and command execution scopes are analyzed for over-privilege.
- Risk Classification: The skill is categorized into a risk tier (Low, Medium, High, or Extreme) based on its functional requirements.
- Report Generation: A comprehensive Skill Vetting Report is produced, culminating in a definitive 'Safe' or 'Do Not Install' verdict.
Skill Vetter Setup
To integrate the vetting protocol into your workflow, you can use the following commands to inspect remote Openclaw Skills repositories:
# Check repository statistics and metadata
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'
# List files within a specific skill directory
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'
# Retrieve the skill definition for manual or agentic review
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"
Skill Vetter Data Schema & Taxonomy
The Skill Vetter produces a structured Skill Vetting Report with the following taxonomy:
| Field | Description |
|---|---|
| Metadata | Skill name, source URL, author, and version string. |
| Metrics | Quantitative data including file count and update frequency. |
| Red Flags | A detailed list of any identified security threats or suspicious patterns. |
| Permissions | Granular list of file system, network, and CLI command access requested. |
| Verdict | Final status: Safe to Install, Install with Caution, or Do Not Install. |
Skill Vetter Advanced Features
- Trust Hierarchy Enforcement: Automatically adjusts scrutiny levels based on source reliability (e.g., Official Openclaw Skills vs. new authors).
- Red Flag Detection Engine: Scans for specific vulnerabilities like
eval()usage, obfuscated code, and unauthorized access to identity files. - Human-in-the-Loop Triggers: Automatically pauses installation and requests human approval for skills classified as High Risk.
- Agent-to-Agent Verification: Facilitates secure sharing of skills by providing a verifiable audit trail for peer-reviewed components.
SKILL.md
Loading
Related Openclaw Skills
Xiaohongshu Post Summarizer
An AI-powered workflow designed to extract and synthesize core insights from Xiaohongshu posts and their surrounding community discussions.
Clawdit: Agent Belief Systems Auditor
Clawdit is a systematic auditing tool designed to align an AI agent's internal belief system and context files with the user's actual goals.
Shopify Payment Optimizer
A strategic comparison engine to find the most cost-effective cross-border payment stacks for Shopify merchants.
OpenClaw Ops
A comprehensive operational health and diagnostic toolkit designed to prevent and fix OpenClaw agent failures.
Nusii Proposals
A comprehensive integration for managing business proposals, clients, and sales templates via the Membrane framework.
AREMES Catalog Skill
An autonomous commerce interface for browsing, quoting, and purchasing Ryan Seslow's digital art and design archive.
Featured*
