| name | skill-vetter |
| description | Security review for OpenClaw skills before installation. Use when evaluating third-party skills for safety, checking permission scope, detecting suspicious patterns, identifying data exfiltration risks, or auditing skill code. Covers static analysis, permission auditing, dependency scanning, and risk scoring. |
Skill Vetter
Review third-party skills before installing them. Catch security risks early.
Quick Start
python3 scripts/vet.py --skill /path/to/skill
python3 scripts/vet.py --slug some-skill
What It Checks
- Permission scope — Does the skill request exec, network, or file access?
- Suspicious patterns — eval(), exec(), subprocess, fetch to unknown hosts, encoded strings
- Data exfiltration — Sending data to external endpoints, logging secrets
- Dependency risks — Known vulnerable packages, excessive dependencies
- Code quality — Minified/obfuscated code, missing SKILL.md, oversized files
- Secret exposure — Hardcoded API keys, tokens, passwords in source
Risk Score
Each check produces a risk score 0-100:
- 0-20: ✅ Safe — install freely
- 21-50: ⚠️ Caution — review findings before installing
- 51-75: 🚨 Risky — significant security concerns
- 76-100: ❌ Dangerous — do not install
Output
SKILL: some-skill
RISK: 35/100 (Caution)
FINDINGS:
⚠️ Uses subprocess.call() in scripts/run.sh:3
⚠️ Fetches from https://unknown-api.com in scripts/pull.py:12
✅ No hardcoded secrets found
✅ SKILL.md present and valid
