Skill Vetter

{
  "schema_version": "2.0",
  "meta": {
    "generated_at": "2026-03-23T08:28:46.539Z",
    "slug": "useai-pro-skill-vetter",
    "source_url": "https://github.com/useai-pro/openclaw-skills-security/tree/main/skills/skill-vetter/",
    "source_ref": "main",
    "model": "claude",
    "analysis_version": "3.0.0",
    "source_type": "community",
    "content_hash": "c69bab1710f05965910686cfdca4053e4d400384ca7d1fb2ea55acbd5f3ccbf9",
    "tree_hash": "7ca2ed21713c138e0eb460425a4dddbc84e1bd2e23fff900fc8694a1bdcac0f8"
  },
  "skill": {
    "name": "skill-vetter",
    "description": "Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.",
    "summary": "Manual security checklist for vetting OpenClaw skills before installation",
    "icon": "🔒",
    "version": "1.0.0",
    "author": "useai-pro",
    "license": "MIT",
    "category": "security",
    "tags": [
      "security",
      "audit",
      "vetting",
      "code-review",
      "checklist"
    ],
    "supported_tools": [
      "claude",
      "codex",
      "claude-code"
    ],
    "risk_factors": []
  },
  "security_audit": {
    "risk_level": "safe",
    "is_blocked": false,
    "safe_to_publish": true,
    "summary": "All 38 static findings are false positives. The scanner detected malicious pattern EXAMPLES that this skill teaches users to IDENTIFY in other skills. This is a pure documentation/checklist skill with no executable code. Lines 67-68 document credential file paths as red flags to watch for. Lines 74-77 list system file modifications as warning patterns. Lines 88-92 show typosquatting examples. The skill intent is purely defensive: teaching users to recognize security threats in other skills.",
    "risk_factor_evidence": [],
    "critical_findings": [],
    "high_findings": [],
    "medium_findings": [],
    "low_findings": [
      {
        "title": "Static scanner detected example patterns",
        "description": "The static analyzer flagged 38 patterns including shell commands, file access, and prompt injection. All are false positives - they appear in Markdown code blocks as EXAMPLES of what to watch for when auditing other skills. This skill contains no executable code.",
        "locations": [
          {
            "file": "SKILL.md",
            "line_start": 67,
            "line_end": 77
          },
          {
            "file": "SKILL.md",
            "line_start": 88,
            "line_end": 92
          }
        ],
        "confidence": 0.98,
        "confidence_reasoning": "Clear context: these patterns appear in documentation sections titled 'Critical (block immediately)' and 'Warning (flag for review)' as examples to detect, not execute."
      }
    ],
    "dangerous_patterns": [],
    "files_scanned": 1,
    "total_lines": 140,
    "audit_model": "claude",
    "audited_at": "2026-03-23T08:28:46.539Z",
    "risk_factors": []
  },
  "content": {
    "user_title": "Vet OpenClaw Skills Before Install",
    "value_statement": "Installing unvetted skills risks code execution, data theft, and system compromise. This checklist provides a structured security audit workflow to identify malicious patterns before installation.",
    "seo_keywords": [
      "Claude",
      "Codex",
      "Claude Code",
      "OpenClaw security",
      "skill audit",
      "code review checklist",
      "security vetting",
      "malware detection",
      "permission analysis",
      "typosquatting"
    ],
    "actual_capabilities": [
      "Analyzes SKILL.md frontmatter for permission scope and metadata consistency",
      "Detects credential access patterns (~/.ssh, ~/.aws, ~/.env references)",
      "Identifies data exfiltration indicators (curl, wget, nc, bash commands)",
      "Flags prompt injection attempts and instruction override patterns",
      "Checks for typosquatting attacks against known legitimate skill names",
      "Provides structured SAFE/WARNING/DANGER/BLOCK verdict system"
    ],
    "limitations": [
      "Manual review process requiring human judgment for each finding",
      "Cannot execute dynamic analysis or runtime behavior testing",
      "Relies on accuracy of skill author's declared metadata",
      "Does not detect obfuscated malicious code outside documentation",
      "Requires knowledge of legitimate skill ecosystem to spot typosquatting",
      "Static analysis only - cannot catch runtime-only threats"
    ],
    "use_cases": [
      {
        "title": "Pre-install security audit",
        "description": "Run this vetting checklist before installing any new OpenClaw skill from ClawHub, GitHub, or community sources to prevent malware installation.",
        "target_user": "Developers installing third-party skills"
      },
      {
        "title": "Periodic skill review",
        "description": "Re-audit already-installed skills during security reviews or after version updates, since safe skills can become malicious in new versions.",
        "target_user": "Security teams and DevOps engineers"
      },
      {
        "title": "Shared skill verification",
        "description": "When someone shares a skill file directly or via messaging, use this checklist to assess its safety before installing it in your environment.",
        "target_user": "Teams receiving skill recommendations"
      }
    ],
    "prompt_templates": [
      {
        "title": "Basic skill vetting",
        "prompt": "Vet this skill for safety using the security checklist: [paste SKILL.md content or provide file path]",
        "scenario": "Quick pre-install check for a new skill from an unknown author"
      },
      {
        "title": "Permission analysis",
        "prompt": "Analyze the permission requests in this skill's frontmatter. Explain why each permission is needed and flag any unnecessary or overly broad access: [skill content]",
        "scenario": "Deep dive into permission scope before granting access"
      },
      {
        "title": "Typosquat detection",
        "prompt": "Check if 'skill-name-here' is a typosquatting attack. Compare it against known legitimate OpenClaw skills and flag any suspicious character substitutions or misspellings.",
        "scenario": "Verifying a skill name that looks similar to a popular tool"
      },
      {
        "title": "Full security audit",
        "prompt": "Perform a complete security vetting of this skill using the Skill Vetter protocol. Analyze metadata, permissions, content for red flags, and provide a SAFE/WARNING/DANGER/BLOCK verdict with detailed findings: [full skill file]",
        "scenario": "Comprehensive audit for high-risk or production environment deployment"
      }
    ],
    "output_examples": [
      {
        "input": "Vet this skill before I install it: [pastes SKILL.md content requesting network + shell permissions with curl commands]",
        "output": "SKILL VETTING REPORT\n====================\nVERDICT: DANGER\n\nPERMISSIONS:\n  network:   DENIED — Requests network access without specifying endpoints\n  shell:     DENIED — Requests shell execution with curl commands present\n\nRED FLAGS: 3\n[CRITICAL] Line 45: Contains 'curl http://external-server' - potential data exfiltration\n[CRITICAL] Line 67: References ~/.ssh credential directory\n[HIGH] Network + shell combination enables data exfiltration\n\nRECOMMENDATION: do not install"
      },
      {
        "input": "Is 'git-commiter' a typosquat of 'git-commit-helper'?",
        "output": "TYPOSQUAT DETECTED\n==================\nTarget: git-commit-helper (legitimate)\nSuspect: git-commiter\n\nAnalysis:\n- Missing 't' in 'commit' → 'commiter'\n- Extra 'e' at end\n- Character distance: 2 edits\n- Known legitimate skill exists\n\nVERDICT: BLOCK - Typosquatting attack detected"
      },
      {
        "input": "Analyze permissions for this code formatter skill: [skill with only fileRead permission]",
        "output": "PERMISSION ANALYSIS\n===================\nSkill: code-formatter-v1\n\nPermissions Granted:\n✓ fileRead — Low risk. Necessary to read source files for formatting.\n\nPermissions Requested: None\n\nRisk Assessment: LOW\n- No network access (no data exfiltration risk)\n- No file write (safe read-only operation)\n- No shell execution (no command injection risk)\n\nVERDICT: SAFE - Permission scope appropriate for stated functionality"
      }
    ],
    "best_practices": [
      "Always run this vetting checklist before installing any skill, even from popular authors, since safe skills can become malicious in updates",
      "Pay special attention to skills requesting both network and shell permissions - this combination enables data exfiltration",
      "Verify the author field and cross-reference with their public GitHub profile or official OpenClaw repository",
      "Run suspicious skills in a sandboxed environment first to observe actual runtime behavior before granting full permissions"
    ],
    "anti_patterns": [
      "Installing skills directly from ClawHub without reviewing the SKILL.md file content",
      "Approving network or shell permissions when the skill description doesn't explain why they're needed",
      "Assuming a skill is safe because it has many downloads or positive reviews - review each version individually",
      "Skipping typosquatting checks for skills with names similar to popular tools"
    ],
    "faq": [
      {
        "question": "What is the difference between WARNING and DANGER verdict?",
        "answer": "WARNING means the skill has suspicious patterns that need explanation but might be legitimate. DANGER means clear malicious indicators are present, like credential access or data exfiltration commands. WARNING skills need more review. DANGER skills should be blocked."
      },
      {
        "question": "Why is network + shell permission combination flagged as critical?",
        "answer": "Network access allows sending data to external servers. Shell access allows executing system commands. Together, they enable data exfiltration: an attacker can read sensitive files and send them to remote servers via shell commands like curl or wget."
      },
      {
        "question": "Can I trust skills from well-known authors without vetting?",
        "answer": "No. Always vet every skill, even from trusted authors. Accounts can be compromised. Safe skills can receive malicious updates. Version 1.0 might be safe while version 1.1 adds backdoors. This checklist takes 2 minutes and prevents supply chain attacks."
      },
      {
        "question": "What should I do if I find a malicious skill?",
        "answer": "Do not install it. Report the skill to the OpenClaw security team and UseClawPro. Include the skill name, author, and the red flags you found. If you already installed it, revoke its permissions immediately and audit your system for suspicious activity."
      },
      {
        "question": "How do I check if a skill name is typosquatting?",
        "answer": "Compare it against known legitimate skills. Look for single-character changes, swapped letters, or homoglyph substitution. This skill's typosquat detection section shows common attack patterns like 'git-commiter' vs 'git-commit-helper'. When in doubt, search the official repository."
      },
      {
        "question": "Does this skill replace automated security scanning tools?",
        "answer": "No. This is a manual pre-install checklist. Use it alongside automated scanning tools. The checklist helps you quickly filter obvious threats before installation. Automated tools provide deeper analysis during development and CI/CD pipelines. Both layers work together for defense."
      }
    ]
  },
  "file_structure": [
    {
      "name": "SKILL.md",
      "type": "file",
      "path": "SKILL.md",
      "lines": 140
    }
  ]
}