Clawhub Skill Vetting

ClawHub Skill Vetting

Overview

Apply a strict, security‑first vetting workflow before installing any ClawHub skill. Prioritize code review, permission scope, domain listing, and risk scoring.

Workflow

1) Source check — author reputation, stars/downloads, last update, reviews. 2) Code review (MANDATORY) — scan all files for exfiltration, secrets access, eval/exec, obfuscation. 3) Permission scope — files, commands, network; confirm minimal scope. 4) Recent activity — detect suspicious bursts. 5) Community check — Discord/GitHub Discussions. 6) Install safely — sandbox + inspect permissions.

Reference

Use `references/vetting-guide.md` for the full checklist, commands, red flags, confidence scoring, and report template.

Output expectations

• Produce the SKILL VETTING REPORT format.
• Provide a go/no‑go recommendation with reasons.
• If unclear, recommend sandbox install only or reject.
• Call out any red flags explicitly.
• Include a confidence score and threshold.

Skill Vetting (ClawHub)

Security‑first vetting protocol for OpenClaw/ClawHub skills. The goal is to prevent installing untrusted skills by enforcing code review, scope checks, and a standardized risk report.

What it does

• Forces code review (SKILL.md alone is not enough)
• Detects red flags (exfiltration, obfuscation, exec/eval, secrets access)
• Checks recent activity to catch supply‑chain risks
• Enforces permission scope and explicit domain listing
• Produces a standard report with a confidence score (0–100)

Files

• SKILL.md — the skill instructions and workflow
• references/vetting-guide.md — full checklist, commands, red flags, report template

How to use (in OpenClaw)

Ask the agent to vet a skill:

Vet this ClawHub skill: <link>

The output will be a SKILL VETTING REPORT with:

• Metrics (downloads, last update, files reviewed)
• Red flags
• Permissions needed
• Confidence score + risk level
• Final verdict

Hard rules

• SKILL.md is not enough — provide the code for a final verdict
• If in doubt → do not install

Confidence score

Weighted rubric (0–100):

• Provenance/author (0–25)
• Code transparency (0–25)
• Permission scope (0–20)
• Network risk (0–15)
• Community signals (0–15)

Thresholds:

• 80–100 → ✅ OK (sandbox still recommended)
• 60–79 → ⚠️ Caution (sandbox + read‑only for non‑sensitive paths)
• <60 → ❌ No‑go

Notes

This skill is preventive. It reduces risk but does not guarantee safety.

ClawHub Skill Vetting — Trust but Verify

Context

ClawHub is OpenClaw’s community skill marketplace. Malicious or unsafe skills exist (exfiltration, prompt injection, hidden instructions). Use this guide before installing any skill.

---

Hard rule

SKILL.md is not enough. Provide the code for a final verdict.

---

1) Source check

Questions:

• Where did this skill come from?
• Is the author known/reputable?
• Downloads/stars?
• Last updated?
• Any reviews from other agents?

2) Code review (MANDATORY)

Clone first do not install blindly:

git clone https://github.com/author/skill-name
cd skill-name

List code files:

find . -type f -name "*.ts" -o -name "*.js" -o -name "*.py"

Search for suspicious patterns:

grep -r "fetch\|axios\|http\|request" --include="*.ts" --include="*.js"
grep -r "env\|secret\|key\|token\|password" --include="*.ts" --include="*.js"
grep -r "eval\|exec\|spawn\|child_process" --include="*.ts" --include="*.js"

🚨 Reject immediately if you see

• curl/wget to unknown URLs
• Sends data to external servers
• Requests credentials/tokens/API keys
• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md without explicit consent
• Base64 decode of opaque blobs
• eval() / exec() with external input
• Modifies system files outside workspace
• Installs packages without listing them
• Network calls to IPs instead of domains
• Obfuscated/minified code
• Requests elevated/sudo permissions
• Accesses browser cookies/sessions
• Touches credential files

3) Permission scope

Evaluate:

• Files it needs to read/write
• Commands it runs
• Network access (to where?)
• Is scope minimal for stated purpose?

4) Recent activity (supply‑chain risk)

git log --oneline -10
git diff HEAD~10..HEAD

Red flag: dormant for months then huge update.

5) Community check

Search OpenClaw Discord + GitHub Discussions for prior reviews.

---

Install safely (even after vetting)

openclaw skill install author/skill-name --sandbox
openclaw skill inspect author/skill-name

--sandbox runs the skill in isolation: no filesystem, no env vars, no access to other skills.

---

Risk classification

• 🟢 LOW: notes, weather, formatting → basic review OK
• 🟡 MEDIUM: file ops, browser, APIs → full review required
• 🔴 HIGH: credentials, trading, system access → human approval required
• ⛔ EXTREME: security configs/root → do not install

---

Confidence score (0–100)

How to score (simple weighted rubric):

• Provenance/author (0–25): known + active = 25; unknown = 5
• Code transparency (0–25): full readable code = 25; partial/obfuscated = 0
• Permission scope (0–20): minimal + coherent = 20; excessive = 0
• Network risk (0–15): known domains listed = 15; unknown/IPs = 0
• Community signals (0–15): positive reviews/benign scan = 15; flagged = 0

Thresholds

• 80–100 → ✅ OK (sandbox still recommended)
• 60–79 → ⚠️ caution (sandbox + read‑only for non‑sensitive paths)
• <60 → ❌ no‑go

---

Output format

SKILL VETTING REPORT
══════════════════════════════════════
Skill: [name]
Source: [ClawHub / GitHub / other]
Author: [username]
Version: [version]
───────────────────────────────────────
METRICS:
• Downloads/Stars: [count]
• Last Updated: [date]
• Files Reviewed: [count]
───────────────────────────────────────
RED FLAGS: [None / List them]
PERMISSIONS NEEDED:
• Files: [list or "None"]
• Network: [list or "None"]
• Commands: [list or "None"]
───────────────────────────────────────
CONFIDENCE SCORE: [0–100]
RISK LEVEL: [🟢 LOW / 🟡 MEDIUM / 🔴 HIGH / ⛔ EXTREME]
VERDICT: [✅ SAFE TO INSTALL / ⚠️ INSTALL WITH CAUTION / ❌ DO NOT INSTALL]
NOTES: [Any observations]
══════════════════════════════════════

---

Quick vet commands (GitHub‑hosted)

curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

---

Trust hierarchy

• Official OpenClaw skills → lower scrutiny (still review)
• High‑star repos (1000+) → moderate scrutiny
• Known authors → moderate scrutiny
• New/unknown sources → maximum scrutiny
• Skills requesting credentials → human approval always

---

Final rule

No skill is worth compromising security. When in doubt, don’t install.

---

Next hardening steps

• Network security + gateway checklist
• DM policies & pairing
• Sandboxing strategy
• API keys & tool policies