Menu
Multi-scanner security gate. TRIGGER when: user mentions installing, adding, or reviewing a skill to Claude Code, OpenClaw, or any other AI agent. Detects malicious code, vulnerabilities, and suspicious patterns.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
| name | skill-vetter |
| version | 1.0.0 |
| user-invocable | true |
| description | Multi-scanner security gate. TRIGGER when: user mentions installing, adding, or reviewing a skill to Claude Code, OpenClaw, or any other AI agent. Detects malicious code, vulnerabilities, and suspicious patterns. |
Security gate that runs multiple scanners against a skill before installation.
Use before installing ANY skill to Claude Code, OpenClaw, or your other favorite AI agent — whether from ClawHub, GitHub, or any external source.
Ask the user: "Should I run skill-vetter on this before installing?" whenever they mention installing a new skill.
bash {baseDir}/scripts/check-deps.sh
Fix any missing dependencies before proceeding.
bash {baseDir}/scripts/vett.sh "<skill-name-or-path>"
The argument can be:
youtube-summarizehttps://github.com/user/repo/tmp/my-skill/| Verdict | Meaning | Action |
|---|---|---|
| BLOCKED | CRITICAL or HIGH findings | Do NOT install. Show findings. |
| REVIEW | Medium severity findings | Show findings, ask user to decide. |
| SAFE | All scanners passed | Proceed with installation. |
Always show the user:
Never install the skill automatically. Always confirm with the user after showing results.
| Scanner | What It Checks |
|---|---|
| aguara | Prompt injection, obfuscation, suspicious LLM calls |
| skill-analyzer | Known malicious patterns, CVE database |
| secrets-scan | Hardcoded API keys, tokens, credentials |
| structure-check | Missing SKILL.md, malformed YAML, dangerous files |
════════════════════════════════════════════════════════════
SKILL VETTER — Security Scan: malicious-skill
Path: /tmp/skill-vetter-abc123/malicious-skill
════════════════════════════════════════════════════════════
[1/4] aguara............. ✅ PASS
[2/4] skill-analyzer..... ❌ FAIL (HIGH: prompt injection pattern)
[3/4] secrets-scan....... ⚠️ WARN (Medium: base64 encoded string)
[4/4] structure-check.... ✅ PASS
════════════════════════════════════════════════════════════
VERDICT: BLOCKED
Reasons: 1 HIGH, 1 MEDIUM
════════════════════════════════════════════════════════════
Do NOT install this skill. It contains:
- HIGH: Prompt injection in SKILL.md (line 47)
- MEDIUM: Base64 encoded string in scripts/run.sh (line 12)
aguara — Go-based prompt scannerskill-analyzer — Cisco AI skill scanner (Python)python3 — For additional checkscurl, jq — For API calls and JSON parsingRun check-deps.sh to verify all tools are installed.
🧠 ontology-clawra v5.1 - Local Ontology Reasoning & Learning Engine **USE THIS SKILL WHENEVER** you need structured reasoning, knowledge graph management, logical inference, or learning from interactions. This is your go-to tool for: - Building and querying ontology knowledge graphs (concepts, entities, relationships) - Performing confidence-based reasoning with evidence tracking - Recording insights and patterns from completed tasks - Local memory search and knowledge retrieval **Key Use Cases:** - Before making complex decisions: "Let me use ontology-clawra to reason about this" - After completing tasks: "Record this learning to ontology-clawra" - Building domain expertise: "Create concepts for [domain] in ontology-clawra" - Analyzing patterns: "Query ontology-clawra for similar past cases" **Core Capabilities:** ✅ Local ontology storage in `~/.openclaw/skills/ontology-clawra/memory/` ✅ Confidence calculation (CONFIRMED/ASSUMED/SPECULATIVE) ✅ Learning from user confirmations ✅ Local memory search (no ne
Complete guide to using and extending Hermes Agent — CLI usage, setup, configuration, spawning additional agents, gateway platforms, skills, voice, tools, profiles, and a concise contributor reference. Load this skill when helping users configure Hermes, troubleshoot issues, spawn agent instances, or make code contributions.
Git push to HTTPS remote using token authentication — avoids SSH setup, works in CI/automated environments.
从 GitHub 历史中彻底清除敏感文件的完整流程 — 使用 git filter-repo + force push，适用于清理意外提交的个人文件、工作文件等
清理 GitHub 历史和 ClawHub 中意外泄露的个人/工作文件
Configure WhatsApp and Telegram messaging platforms on Hermes Agent