A security-first vetting protocol designed to audit AI agent skills for malicious patterns and permission overreach before installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-vetter
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-vetter using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Vetter?
Skill Vetter is an essential security layer for developers and users of AI agents. It provides a standardized framework to evaluate third-party extensions, ensuring that no malicious code enters your workspace. By systematically checking for red flags such as unauthorized network calls, credential access, and obfuscated code, this tool protects your data and system integrity.
Integrating this protocol into your workflow ensures that any Openclaw Skills you deploy are thoroughly inspected for safety. It transforms the risky process of installing community-contributed tools into a structured, safety-first workflow, emphasizing the philosophy that security is a non-negotiable feature in the agentic ecosystem.
Skill Vetter Use Cases
- Before installing any new extension from ClawdHub or community repositories.
- Evaluating skills shared between agents in a multi-agent environment.
- Auditing GitHub repositories before running remote code.
- Assessing the safety of skills that request sensitive file system permissions or API tokens.
How Skill Vetter Works
- Source Verification: Analyze the origin, author reputation, and community engagement metrics of the skill.
- Mandatory Code Review: Perform a deep scan of all skill files to identify suspicious patterns like base64 decoding, eval() calls, or hidden external network requests.
- Permission Mapping: Evaluate the requested file system and network scopes to ensure they are minimal and align with the skill's stated purpose.
- Risk Classification: Categorize the skill from Low to Extreme risk based on the potential impact on the host system.
- Report Generation: Produce a standardized Skill Vetting Report including a final safety verdict.
Skill Vetter Setup
The Skill Vetter protocol relies on standard CLI tools like curl and jq for repository analysis. To begin vetting Openclaw Skills hosted on GitHub, you can utilize the following investigative commands:
# Check repository metadata and activity
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'
# List all files within the specific skill directory
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'
# Fetch and manually inspect the SKILL.md definition
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"
Skill Vetter Data Schema & Taxonomy
Skill Vetter organizes its findings into a structured report to ensure consistency across different Openclaw Skills. The schema includes:
| Attribute | Description |
|---|---|
| Metrics | Quantitative data including star counts, update frequency, and files reviewed. |
| Red Flags | A list of critical security violations or suspicious code patterns identified during review. |
| Permissions | A detailed list of requested access for Files, Network, and CLI Commands. |
| Risk Level | A qualitative rating: Low (Notes/Weather), Medium (Browser/API), High (Credentials), or Extreme (Root access). |
| Verdict | Final recommendation: Safe to Install, Install with Caution, or Do Not Install. |
Skill Vetter Advanced Features
- Trust Hierarchy implementation to automatically prioritize official Openclaw Skills over unverified sources.
- Deep-scan checklists for sensitive file access, including SSH keys, AWS configs, and identity files.
- Standardized reporting format compatible with agent memory for cross-session security awareness.
- GitHub API integration for rapid health and reputation checks of remote repositories.
SKILL.md
Loading
Related Openclaw Skills
CrabNet
CrabNet is a cross-agent collaboration protocol and registry API designed for discovery, capability registration, and task exchange between autonomous agents.
AWS Security Scanner
A comprehensive security auditing tool for AWS infrastructure that identifies misconfigurations and vulnerabilities across S3, IAM, EC2, and RDS.
OpenClaw Shield Quick Scan
A high-speed security scanning skill designed to identify credential theft, data exfiltration, and suspicious command execution within codebases.
OpenClaw Policy Check
A lightweight security scanner designed to detect high-risk patterns and policy violations in code and scripts before execution.
Slack Power Tools
A comprehensive toolkit for advanced Slack workspace administration, automation, and deep analytics via the Slack Web API.
omni-stories
Omni Stories enables AI agents to autonomously generate fully narrated Reddit story videos with background footage and synchronized captions.
Featured*
