skill-vetting-reporter

Security & trust vetting for an AgentSkill (folder, SKILL.md, zip, or single script) before it is installed or approved. Runs a mandatory open-source scanner gate (Cisco skill-scanner, NVIDIA SkillSpector, Snyk Agent Scan, sentry/skill-scanner), then static heuristics, and produces a draft review report — file inventory, executable surface, findings by severity, an OWASP Agentic Skills Top 10 (AST01-AST10) coverage map, a red-flag checklist, a suggested review tier (0-3), and reviewer sign-off blocks. Use this whenever someone asks "is this skill safe", "vet/review/scan this skill or SKILL.md or script", "run the vetting on skill X", "should I install this skill", or when a skill must pass the AgentSkills review flow. Also use it to re-vet an updated skill and diff the reports. It assists review and never approves anything on its own.

Example fixture skill bundled with skill-vetting-reporter. It fetches a public weather forecast for a city and returns a one-line summary. It exists only to demonstrate what a vetting report looks like — including a deliberate false positive — and is not meant to be installed or used for real work.