skill-vetter

What This Skill Does

Skill Vetter is the primary security defense mechanism for the OpenClaw ecosystem. It is an automated auditing tool designed to inspect, analyze, and grade third-party AI skills before they are integrated into your agent's environment. By enforcing a rigorous, multi-step vetting protocol, Skill Vetter identifies malicious patterns, excessive permission requests, and suspicious code structures, ensuring that you only deploy trusted extensions to your agent.

Installation

To install the Skill Vetter, ensure you have the OpenClaw environment initialized. Run the following command in your agent's terminal:

clawhub install openclaw/skills/skills/spclaudehome/skill-vetter

Once installed, the tool acts as a pre-processing step for any new asset you consider adding to your local library.

Use Cases

• ClawdHub Verification: Use this before pulling any community-submitted plugin from the public repository.
• GitHub Auditing: Run this on external code repositories to detect obfuscated logic or unauthorized file system access.
• Agent Collaboration: If another agent suggests a skill, use this tool to ensure it does not attempt to access your sensitive IDENTITY.md or MEMORY.md files.
• Dependency Management: Use it to confirm that a skill's declared permissions match its stated functionality, preventing scope creep.

Example Prompts

1. "I am thinking about installing 'Crypto-Trader-Bot' from GitHub. Can you run skill-vetter on the repo URL and give me a risk assessment?"
2. "Please audit the files in './downloads/new-plugin' using the skill-vetter protocol. I want to know if it attempts to make network calls to any unknown IP addresses."
3. "Vetter report, please. I just downloaded a web-scraper plugin. Let me know if it requests read access to my local SSH keys or configuration files."

Tips & Limitations

• Never Skip Step 2: The code review is mandatory. While the tool helps highlight red flags, your oversight is the final line of defense.
• Stay Updated: Always ensure your skill-vetter definitions are current, as new obfuscation techniques are constantly emerging.
• Contextual Awareness: The tool provides a 'Risk Classification' based on objective findings; however, always manually evaluate the 'Extreme' risk cases by seeking human authorization before proceeding.