skill-vetter

To check if an AI agent skill is safe to install, perform a security vetting process that assesses package provenance, scans code for credential access attempts, and evaluates requested permission scopes. This produces a structured report with a clear go or no-go installation verdict.

Security vetting for AI agent skills is a review process that screens packages for malicious behaviors like obfuscation and suspicious network activity. It evaluates author reputation, analyzes permission requests, and assigns a risk classification to determine if installation is safe.

Perform a mandatory code review on the ClawdHub skill package by inspecting its files for red flags like unsafe system modifications and credential access. Combine this content review with a permission scope evaluation to generate a vetting report with an explicit installation verdict.

Yes, skill vetting checks for credential safety and network access risks by screening skill files for red-flag behaviors. It specifically looks for credential access attempts, obfuscation, and suspicious network activity, then evaluates required file and command permissions to classify overall risk.

Before installing an external AI agent skill, review its requested file, network, and command permissions. Evaluating this permission scope is a mandatory part of the vetting process, allowing you to determine if the access level is justified or poses a security risk.

You should refuse to install an AI agent skill package when the vetting report identifies severe red flags like obfuscation or unauthorized credential access. If the permission scope is excessive or the author reputation is not credible, decline the installation pending human approval.