skill-vetter

Run skill-vetter on the candidate skill to vet third-party AI skills for credential access, unauthorized network calls, and code obfuscation red flags before installation. It provides a risk rating, permission mapping, and structured security report.

Skill vetting is the process of evaluating third-party plugins or repository installs to detect credential leakage and privilege escalation. You need a risk assessment before installing third-party AI skills to satisfy compliance gatekeeping requirements and keep the host environment safe.

To generate a structured security report and permission mapping, run skill-vetter on the manual skill upload. It clarifies required file, network, and environment accesses, assigns a LOW–EXTREME risk rating, and formats the verdict for compliance teams.

Yes, skill-vetter performs source and reputation review by checking author reputation, documentation freshness, and popularity before trust decisions. This is integrated directly into the AI safety compliance check.

Yes, skill-vetter detects eval/exec usage, obfuscation, unauthorized network calls, credential access, and privilege escalation attempts in repository installs. Its red flag detection identifies hidden execution flows to prevent credential leakage.

Automated skill vetting provides risk ratings and permission mappings based on detected red flags like unauthorized network calls and code obfuscation. While it satisfies compliance gatekeeping requirements, it should be reviewed alongside the generated structured security report for final trust decisions.