skill-vetter

To vet AI agent skills for security risks, run a multi-step workflow that checks source reputation, reviews code for insecure patterns, and classifies risk levels. This generates a standardized vetting report to ensure safe deployment.

Skill vetting is the process of evaluating AI agent skills for security risks before integrating them. You need it when installing skills from sources like GitHub or ClawdHub to verify origin, check permissions, and prevent unsafe code execution.

To check code for red flags, perform a mandatory review of all files to highlight insecure patterns and compliance gaps. You assess permission scope by evaluating the skill's access requirements and assigning a standardized risk classification.

Yes, the vetting workflow provides remediation guidance for high-risk skills. After risk classification, it delivers actionable steps to remediate identified security vulnerabilities and compliance gaps before you proceed with deployment.

Yes, you can assess update history and origin reputation for ClawdHub skills. The source check verifies the origin, evaluates the reputation across ClawdHub and GitHub, and reviews the update history to flag potential security concerns.

Automated code review during skill vetting focuses on highlighting insecure patterns and red flags but may not catch complex contextual logic flaws. It assigns risk levels and generates remediation steps, requiring human oversight for final deployment decisions.