skill-vetter

To vet AI skills for security risks, apply source verification, mandatory code review, permission scope assessment, and risk classification. This process identifies red flags and determines a trust level to produce a structured safety report with an install verdict.

When reviewing AI skills from GitHub or ClawdHub, check for suspicious patterns, excessive permission scopes, and unverified sources. A proper security vetting process classifies these red flags to determine the risk level and generate a standardized safety report.

Assessing the permission scope of an AI skill involves evaluating required permissions during a mandatory code review. This risk assessment identifies excessive access privileges, classifies them as red flags, and determines an overall trust level before installation.

Code review is a mandatory step to determine the trust level of third-party AI skills. By analyzing the code alongside source verification and permission scope assessment, the vetting process classifies security risks and outputs a clear install verdict.

The best way to generate a standardized vetting report is to apply a stepwise security protocol covering source verification, code review, and risk classification. This produces a structured document detailing red flags, required permissions, and an install verdict.

You should avoid installing an AI skill when the risk assessment identifies unverified sources, excessive permission scopes, or suspicious code patterns. The vetting report will explicitly state these red flags and issue a negative install verdict to prevent security breaches.