skill-vetter

To check third-party AI skills for security risks, review the source reputation, inspect all skill files for malicious patterns like hidden network calls, and evaluate command execution and file access permissions to produce a structured vetting report.

The best way to assess untrusted AI skill permissions is to perform mandatory code review and permission scoping, determining the minimum files, commands, and network access the skill actually needs before installation to prevent excessive privileges.

Yes, you can evaluate skills from GitHub, ClawdHub, and other untrusted sources by checking for credential access, system modifications, and suspicious network behavior to ensure source reputation and trust signals are sufficient before proceeding.

To classify the risk level of a third-party AI skill, inspect all files for security red flags and excessive permissions, then categorize the skill as low, medium, high, or extreme risk based on the vetting report findings.

Security red flags to look for when reviewing AI skills include credential access, hidden network calls, code obfuscation, dangerous command execution, and unauthorized system modifications that indicate potentially malicious behavior.