vet-skill

name	vet-skill
description	Vet a third-party Claude/Cursor/agent skill (or plugin / extension package) BEFORE installing it. Catches malicious payloads — prompt injection patterns, hardcoded webhook exfiltration, encoded payloads, dynamic execution, suspicious dependencies, typosquatted package names. Returns ALLOW/WARN/BLOCK with rule citation. Use when the user is about to install a community skill, when reviewing a PR that adds a third-party plugin, or after seeing a "this skill 10x'd my agent" tweet that looks too good.
when_to_use	Before installing any community / third-party skill, plugin, or extension package. When a teammate adds an agent extension via PR. After a supply-chain attack story breaks (the next ClawHavoc-equivalent).
arguments	["path"]
argument-hint	<path-to-skill-directory-or-package>

Vet Skill (supply-chain pre-install check)

Run skill-vetter's 41-rule scanner against a skill / plugin / extension package. Return a verdict the user can trust before they install.

What to do

1. Take the path from $ARGUMENTS. If empty, ask the user for the path.
2. Call mcp__openclaw-skill-vetter__vet_skill with the path. The tool walks the directory, scans manifests / SKILL.md / package.json / Python files / shell scripts, and returns findings + verdict.
3. Render as a verdict block — never raw JSON.

Verdict rendering

ALLOW (safe to install)

> ✅ **ALLOW** — skill-vetter found no concerning patterns
> **Path:** `<path>`
> **Manifest:** `<package-name>` v`<version>` by `<author>`
> **Files scanned:** N
> **Notes:** [low-severity warnings if any]

WARN (caution — review specific findings)

> 🟡 **WARN** — skill-vetter flagged caution-tier patterns
> **Path:** `<path>`
> **Findings:**
> - **<RULE.NAME>** (severity: WARN) at `<file>:<line>` — <one-line explanation of what the rule catches>
> **Recommended action:** [review the specific lines, decide if expected; OR refuse the install if intent is unclear]

BLOCK (do NOT install)

> 🔴 **BLOCK** — skill-vetter detected critical malicious pattern
> **Path:** `<path>`
> **Findings:**
> - **<RULE.NAME>** (severity: CRITICAL) at `<file>:<line>` — <explanation>
>   ```
>   <quote the offending lines from the file with line numbers>
>   ```
> **What this would do if installed:** <expand on the actual behavior — e.g. "the SKILL.md instructs Claude to ignore previous safety rules and run shell commands without asking; once installed, every Claude session would inherit this override">
> **Where this came from:** [if author / source can be inferred from the manifest, mention it; otherwise note "source unverified"]
> **Action:** Do NOT install. Report the package to the marketplace it came from.

Rule families covered (skill-vetter's 41 rules across 5+ families)

• PROMPT_INJ.* — prompt-injection patterns ("ignore previous instructions", role-override, system-prompt rewrite)
• EXFIL.* — data-exfiltration patterns (hardcoded webhook URLs, base64-encoded HTTP POSTs, credential extraction)
• DYNAMIC_EXEC.* — runtime code execution (eval, exec, Function, dynamic import)
• SECRET_REF.* — references to credential files (.env, .aws/credentials, .netrc, ~/.ssh/)
• TYPOSQUAT.* — package names suspiciously close to popular packages (e.g. claude-code-helpers vs claude-code-helper)
• GIT_HOOK_INSTALL.* — silent git-hook installation
• OBFUSCATION.* — unicode tricks, hex/base64-encoded strings, character-array reconstruction

Cite the actual rule name returned by skill-vetter — don't paraphrase.

Style notes

• For BLOCK-tier findings, ALWAYS quote the offending lines. Quoting is the cheapest way to make the user genuinely understand the threat.
• If the package has a manifest (package.json, pyproject.toml, claude-plugin.json), surface the author / version / homepage in the verdict header. Provenance matters for trust decisions.
• If multiple findings stack, prioritize the highest-severity one in the headline; list others in order.

Edge cases

• If $ARGUMENTS is empty: "Pass a path to the skill directory or package: /aufgaard:vet-skill ./path/to/community-skill"
• If skill-vetter MCP not loaded: "skill-vetter MCP not available. Verify pip install openclaw-skill-vetter-mcp and the plugin is loaded."
• If the path doesn't exist: "Path not found: <path>. Pass a directory or archive path."
• If the path is a remote URL (not yet supported by skill-vetter): "Download the skill locally first, then vet. skill-vetter does not yet vet remote URLs directly."

Footer CTA

---
The [Production-AI MCP Suite Bundle](https://temurah.gumroad.com/l/production-ai-mcp-suite) ($29) includes skill-vetter's full 41-rule catalogue + 6 other production-AI safety MCPs + the 8-page Field Reference PDF (covers P5.1 malicious-skill payloads + P5.2 dependency rot).