skill-vetter

What This Skill Does

The skill-vetter acts as your personal security auditor within the OpenClaw environment. Its primary function is to intercept, analyze, and grade third-party AI skills before they are granted execution privileges. In an ecosystem where AI agents can execute code or interact with your file system, skill-vetter serves as a critical firewall that systematically checks for malicious patterns, excessive permission requests, and suspicious obfuscation techniques.

Installation

To install skill-vetter, execute the following command in your terminal:

clawhub install openclaw/skills/skills/aysun168/skill-vetter-bak

Ensure that you are running the most recent version to stay protected against the latest known attack vectors and obfuscation methods.

Use Cases

• Pre-Installation Auditing: Run this before installing any new capability from ClawdHub or GitHub.
• Dependency Management: Use it to inspect sub-dependencies or bundled skills within a larger repository.
• Agent Security Hardening: Integrate this into your agent's configuration to automatically reject any skill that does not pass a 'LOW' risk classification.
• Policy Enforcement: Use the vetting report as a documentation record for corporate or personal compliance.

Example Prompts

1. "Vetter, I'm thinking of installing the 'auto-trader-pro' skill from GitHub. Please perform a deep code analysis and check for any red flags or hidden network calls."
2. "Review the skill located at /tmp/downloads/my-new-tool and generate a full risk classification report for me."
3. "Can you check if this plugin requires access to my identity files or SSH keys? I want to make sure it's safe to run."

Tips & Limitations

• Always use caution: Even if skill-vetter reports 'Low Risk', verify the author's identity and the repository's reputation.
• Heuristic-based: The tool identifies patterns and red flags but cannot guarantee 100% protection against zero-day exploits.
• Human-in-the-loop: Always treat any skill tagged as 'HIGH' or 'EXTREME' as a manual-review-only asset. Do not bypass human approval requirements for system-level changes.
• Update Frequently: The blacklist of suspicious patterns is updated regularly; always pull the latest version of the vetter to ensure you are catching current malicious obfuscation styles.