skill-vetter

To check the security risk of an AI agent skill, you need to evaluate its provenance, scan for suspicious code behavior like credential access or network exfiltration, and assess requested permission scopes to produce a structured risk verdict.

A safety checklist for reviewing unknown GitHub agent skills requires scanning for risky execution primitives, obfuscation, unsafe network activity, and sensitive-file access, ensuring you apply least privilege before adopting the code.

Assess permission scope for ClawdHub skills by enumerating required file access, network needs, and executed commands, then scan code behavior for high-risk patterns to produce a standardized safe, caution, or do not install verdict.

Yes, you can use a structured vetting report to decide whether to install an untrusted AI skill by relying on its clear risk verdict, which classifies the skill as safe, caution, or do not install based on code behavior.

During AI agent code review, you should scan for high-risk patterns including credential access attempts, network exfiltration behavior, obfuscation, and risky execution primitives to ensure safe adoption from unknown authors.