skill-vetter

Vetting AI agent skills involves applying source verification, red-flag detection during code review, and permission scope assessment to classify installation risks and generate a clear safety verdict.

AI agent skill vetting is the process of evaluating external code for malicious behavior before execution. You need it when installing new skills sourced from ClawdHub, GitHub, or other providers to prevent unsafe code from running.

Checking for red flags in skills from GitHub or ClawdHub requires a mandatory code review that scans for malicious patterns, evaluates permission scopes, and assesses code quality to determine if the skill is safe to run.

Yes, the vetting process works with skills sourced from ClawdHub, GitHub, or other providers, applying mandatory source checks and code reviews to evaluate reliability and reputation across different sources.

To run a code review and risk analysis, you need to provide the skill's SKILL.md file and its associated code so the vetting workflow can perform automated checks and classify the installation risk.

Automated risk classification evaluates permission scopes and detects code red flags but may not catch complex obfuscated malicious logic, meaning human oversight is still recommended when evaluating high-risk AI skills.