Clawhub Skill Vetting

# ClawHub Skill Vetting

## Overview
Apply a strict, security‑first vetting workflow before installing any ClawHub skill. Prioritize code review, permission scope, domain listing, and risk scoring.

## Workflow
1) **Source check** — author reputation, stars/downloads, last update, reviews.
2) **Code review (MANDATORY)** — scan all files for exfiltration, secrets access, `eval/exec`, obfuscation.
3) **Permission scope** — files, commands, network; confirm minimal scope.
4) **Recent activity** — detect suspicious bursts.
5) **Community check** — Discord/GitHub Discussions.
6) **Install safely** — sandbox + inspect permissions.

## Reference
Use **`references/vetting-guide.md`** for the full checklist, commands, red flags, confidence scoring, and report template.

## Output expectations
- Produce the **SKILL VETTING REPORT** format.
- Provide a **go/no‑go** recommendation with reasons.
- If unclear, recommend **sandbox install only** or **reject**.
- Call out any **red flags** explicitly.
- Include a **confidence score** and threshold.


# ClawHub Skill Vetting — Trust but Verify

## Context
ClawHub is OpenClaw’s community skill marketplace. Malicious or unsafe skills exist (exfiltration, prompt injection, hidden instructions). Use this guide before installing any skill.

---

## Hard rule
**SKILL.md is not enough.** Provide the code for a final verdict.

---

## 1) Source check
Questions:
- Where did this skill come from?
- Is the author known/reputable?
- Downloads/stars?
- Last updated?
- Any reviews from other agents?

## 2) Code review (MANDATORY)
Clone first **do not install blindly**:
```bash
git clone https://github.com/author/skill-name
cd skill-name
```
List code files:
```bash
find . -type f -name "*.ts" -o -name "*.js" -o -name "*.py"
```
Search for suspicious patterns:
```bash
grep -r "fetch\|axios\|http\|request" --include="*.ts" --include="*.js"
grep -r "env\|secret\|key\|token\|password" --include="*.ts" --include="*.js"
grep -r "eval\|exec\|spawn\|child_process" --include="*.ts" --include="*.js"
```

### 🚨 Reject immediately if you see
- curl/wget to unknown URLs
- Sends data to external servers
- Requests credentials/tokens/API keys
- Reads `~/.ssh`, `~/.aws`, `~/.config` without clear reason
- Accesses `MEMORY.md`, `USER.md`, `SOUL.md`, `IDENTITY.md` without explicit consent
- Base64 decode of opaque blobs
- `eval()` / `exec()` with external input
- Modifies system files outside workspace
- Installs packages without listing them
- Network calls to **IPs** instead of domains
- Obfuscated/minified code
- Requests elevated/sudo permissions
- Accesses browser cookies/sessions
- Touches credential files

## 3) Permission scope
Evaluate:
- Files it needs to read/write
- Commands it runs
- Network access (to where?)
- Is scope minimal for stated purpose?

## 4) Recent activity (supply‑chain risk)
```bash
git log --oneline -10
git diff HEAD~10..HEAD
```
Red flag: dormant for months then huge update.

## 5) Community check
Search OpenClaw Discord + GitHub Discussions for prior reviews.

---

## Install safely (even after vetting)
```bash
openclaw skill install author/skill-name --sandbox
openclaw skill inspect author/skill-name
```
`--sandbox` runs the skill in isolation: no filesystem, no env vars, no access to other skills.

---

## Risk classification
- 🟢 **LOW**: notes, weather, formatting → basic review OK
- 🟡 **MEDIUM**: file ops, browser, APIs → full review required
- 🔴 **HIGH**: credentials, trading, system access → human approval required
- ⛔ **EXTREME**: security configs/root → do **not** install

---

## Confidence score (0–100)
**How to score** (simple weighted rubric):
- **Provenance/author (0–25)**: known + active = 25; unknown = 5
- **Code transparency (0–25)**: full r