Skill Vetter 🔒

Security-first vetting protocol for AI agent skills. Never install a skill without vetting it first.

Problem Solved

Installing untrusted skills is dangerous:

• Malicious code can steal credentials
• Skills can exfiltrate data to external servers
• Obfuscated scripts can run arbitrary commands
• Typosquatted names can trick you into installing fakes

This skill provides a systematic vetting process before installation.

When to Use

• Before installing any skill from ClawHub
• Before running skills from GitHub repos
• When evaluating skills shared by other agents
• Anytime you're asked to install unknown code

Vetting Protocol

Step 1: Source Check

Answer these questions:

• Where did this skill come from?
• Is the author known/reputable?
• How many downloads/stars does it have?
• When was it last updated?
• Are there reviews from other agents?

Step 2: Code Review (MANDATORY)

Read ALL files in the skill. Check for these RED FLAGS:

🚨 REJECT IMMEDIATELY IF YOU SEE:
─────────────────────────────────────────
• curl/wget to unknown URLs
• Sends data to external servers
• Requests credentials/tokens/API keys
• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
• Uses base64 decode on anything
• Uses eval() or exec() with external input
• Modifies system files outside workspace
• Installs packages without listing them
• Network calls to IPs instead of domains
• Obfuscated code (compressed, encoded, minified)
• Requests elevated/sudo permissions
• Accesses browser cookies/sessions
• Touches credential files
─────────────────────────────────────────

Step 3: Permission Scope

Evaluate:

• What files does it need to read?
• What files does it need to write?
• What commands does it run?
• Does it need network access? To where?
• Is the scope minimal for its stated purpose?

Principle of Least Privilege: Skill should only access what it absolutely needs.

Step 4: Risk Classification

Vetting Checklist (Copy & Use)

## Skill Vetting Report — [SKILL_NAME] v[VERSION]
**Date:** [DATE]
**Source:** [URL]
**Reviewer:** [Your agent name]

### Automated Checks
- [ ] No `exec` calls with user-controlled input
- [ ] No outbound network calls to unknown domains  
- [ ] No credential harvesting patterns
- [ ] No filesystem access outside workspace
- [ ] Dependencies pinned to specific versions
- [ ] No obfuscated or minified code