skill-vetter

name	skill-vetter
version	1.0.0
description	Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

Skill Vetter 🔒

Security-first vetting protocol for AI agent skills. Never install a skill without vetting it first.

When to Use

• Before installing any skill from ClawdHub
• Before running skills from GitHub repos
• When evaluating skills shared by other agents
• Anytime you're asked to install unknown code

Vetting Protocol

Step 1: Source Check

Questions to answer:
- [ ] Where did this skill come from?
- [ ] Is the author known/reputable?
- [ ] How many downloads/stars does it have?
- [ ] When was it last updated?
- [ ] Are there reviews from other agents?

Step 2: Code Review (MANDATORY)

Read ALL files in the skill. Check for these RED FLAGS:

🚨 REJECT IMMEDIATELY IF YOU SEE:
─────────────────────────────────────────
• curl/wget to unknown URLs
• Sends data to external servers
• Requests credentials/tokens/API keys
• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
• Uses base64 decode on anything
• Uses eval() or exec() with external input
• Modifies system files outside workspace
• Installs packages without listing them
• Network calls to IPs instead of domains
• Obfuscated code (compressed, encoded, minified)
• Requests elevated/sudo permissions
• Accesses browser cookies/sessions
• Touches credential files
─────────────────────────────────────────

Step 3: Permission Scope

Evaluate:
- [ ] What files does it need to read?
- [ ] What files does it need to write?
- [ ] What commands does it run?
- [ ] Does it need network access? To where?
- [ ] Is the scope minimal for its stated purpose?

Step 4: Risk Classification

Risk Level	Examples	Action
🟢 LOW	Notes, weather, formatting	Basic review, install OK
🟡 MEDIUM	File ops, browser, APIs	Full code review required
🔴 HIGH	Credentials, trading, system	Human approval required
⛔ EXTREME	Security configs, root access	Do NOT install

Output Format

After vetting, produce this report:

SKILL VETTING REPORT
═══════════════════════════════════════
Skill: [name]
Source: [ClawdHub / GitHub / other]
Author: [username]
Version: [version]
───────────────────────────────────────
METRICS:
• Downloads/Stars: [count]
• Last Updated: [date]
• Files Reviewed: [count]
───────────────────────────────────────
RED FLAGS: [None / List them]

PERMISSIONS NEEDED:
• Files: [list or "None"]
• Network: [list or "None"]  
• Commands: [list or "None"]
───────────────────────────────────────
RISK LEVEL: [🟢 LOW / 🟡 MEDIUM / 🔴 HIGH / ⛔ EXTREME]

VERDICT: [✅ SAFE TO INSTALL / ⚠️ INSTALL WITH CAUTION / ❌ DO NOT INSTALL]

NOTES: [Any observations]
═══════════════════════════════════════

Quick Vet Commands

For GitHub-hosted skills:

# Check repo stats
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'

# List skill files
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

# Fetch and review SKILL.md
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

Trust Hierarchy

1. Official OpenClaw skills → Lower scrutiny (still review)
2. High-star repos (1000+) → Moderate scrutiny
3. Known authors → Moderate scrutiny
4. New/unknown sources → Maximum scrutiny
5. Skills requesting credentials → Human approval always

Remember

• No skill is worth compromising security
• When in doubt, don't install
• Ask your human for high-risk decisions
• Document what you vet for future reference

---

Paranoia is a feature. 🔒🦀

---

Marketplace Mode (v0.3)

When invoked with --marketplace-mode flag (or {{TAMER_NAME}} says "vet for marketplace"), runs the formal 7-point Sibling Network skill submission review per template/MARKETPLACE-SPEC.md.

7-Point Vetting Protocol

For each submitted skill, evaluate:

1. Format check — SKILL.md follows shipped format exactly:

   • YAML frontmatter with name + description fields
   • Sections present: Activation / Context Guard / Protocol / Hard Constraints / Karpathy Discipline
   • File structure: SKILL.md (required) + optional README.md, core.md, _meta.json

2. Safety check — no destructive defaults:

   • No rm -rf patterns in any sub-script
   • No curl | bash constructions
   • No silent network calls (telemetry, analytics, callbacks)
   • No credential extraction or env-var harvesting
   • No auto-install of additional dependencies without Tamer approval

3. Scope check — single concern, no shipped-skill overlap:

   • One trigger pattern (or clearly-related cluster)
   • Doesn't replicate functionality from existing 24+ shipped skills
   • If overlap exists, MUST be intentional + documented in description

4. Voice check — partner-aware register:

   • Speaks AS Majimon, not AS service
   • Uses "Tamer" not "user"
   • Pushback discipline preserved
   • Bilingual support respected (placeholder substitution intact for non-English Tamers)

5. Karpathy compliance — explicit Karpathy Discipline section showing:

   • #1 Think Before Coding — clear gate before action
   • #2 Simplicity First — minimum viable scope
   • #3 Surgical Changes — touched files traced to invocation
   • #4 Goal-Driven Execution — verifiable closing condition

6. License check — open license only:

   • MIT-0 / CC0 / Apache-2.0 / BSD acceptable
   • GPL acceptable (compatible with no-resell)
   • Proprietary licenses REJECTED
   • Missing LICENSE = REJECTED

7. Domain tagging — clearly marked if narrow-domain:

   • _meta.json includes category + family_affinity fields
   • Domain-specific skills (e.g., "data science only") tagged honestly
   • Universal skills marked family_affinity: "universal"

Vetter Invocation

node BabyForm/plugins/majimon-skills/skills/skill-vetter/scripts/vet.py \
  --marketplace-mode \
  --target /path/to/submitted-skill/

(If the Python script doesn't exist yet — and it doesn't ship in v0.3 — invoke the SKILL.md protocol manually: read the submitted skill, run through the 7 points, output a structured review.)

Sample Output

=== MAJI-Skills Marketplace Vetting Report ===
Target: notebook-version v0.1.0
Author: @some-tamer
Submitted: 2026-MM-DD

[ ✓ PASS ] Format check — YAML frontmatter valid, sections present
[ ✓ PASS ] Safety check — no destructive defaults, no network calls
[ ✓ PASS ] Scope check — single concern (notebook checkpointing); no shipped-skill overlap
[ ✓ PASS ] Voice check — partner-aware register; uses "Tamer" not "user"
[ ✓ PASS ] Karpathy compliance — all 4 principles addressed in Discipline section
[ ✓ PASS ] License check — MIT-0
[ ✓ PASS ] Domain tagging — marked "data-science", family_affinity "universal"

Recommendation: APPROVE
Reviewer: [reviewer handle]
Reviewed: [ISO datetime]

If any check FAILS, recommendation is REQUEST-CHANGES with specific items to fix. Submitter can revise + resubmit.

Two-Reviewer Rule

Per template/MARKETPLACE-SPEC.md, every submission requires 2 independent reviewers. Reviewers cannot be the submitter. Approval requires both reviewers PASS on all 7 points. One PASS + one REQUEST-CHANGES = REQUEST-CHANGES (revise + resubmit). Reject = both reviewers REJECT (rare, only for blatant violations).

Status

Marketplace registry doesn't exist yet (v0.3 = skill protocol only, infrastructure deferred to community demand per MARKETPLACE-SPEC.md). When the registry materializes, this skill is ready to invoke.