skill-vetter

To check AI agent skills for malicious code, use a security vetting protocol that performs source reputation checks, code review for obfuscated code and credential theft, and permission scope analysis against the principle of least privilege.

Skill vetting is a security protocol that detects unauthorized data access by reviewing code for red flags, analyzing required permissions, and classifying risk levels to ensure safe installation of AI agent skills.

To analyze AI skill permissions and prevent excessive access, evaluate the skill's required permissions against the principle of least privilege as part of a comprehensive security vetting protocol.

Yes, you need curl and jq installed, as these are the required dependencies for executing the security vetting scripts that perform source checking and risk analysis.

The best way to generate a security risk report for AI agent skills is to run a vetting protocol that categorizes risk levels as LOW, MEDIUM, HIGH, or EXTREME and produces a structured report detailing findings and recommendations.

You should not rely solely on automated skill vetting when a skill requires execution in highly sensitive environments, as automated risk classification may miss novel obfuscation techniques not yet captured in reference scripts.