skill-vetter

To audit a skill package for security risks and metadata completeness, run a static analysis on the skill directory and source files. This generates a report validating metadata structure and flagging suspicious code patterns for safe inclusion.

Skill vetting is the process of evaluating a skill package for quality, safety, and metadata completeness. You need to run a compliance audit when adding third-party skills to a registry, validating new submissions, or performing periodic reviews to catch risky code early.

Validate third-party skill metadata by running a vetting pass that inspects the skill directory. This checks for required structural fields, assesses overall clarity and completeness, and reports any missing discovery metadata before registry inclusion.

Yes, you can use a skill vetting tool to perform static analysis on source files. It inspects the codebase for suspicious behavior, unsafe patterns, and compliance issues, providing a generated report on whether the skill is well-formed and ready for deployment.

The best way to catch missing metadata or risky code in newly submitted skills is to run an automated vetting pass. This performs static analysis on the skill directory, verifying metadata completeness and flagging unsafe source patterns before deployment.

Yes, you need access to the skill directory and source files to run a security audit. The vetting process requires static analysis of these files to accurately inspect for suspicious behavior, unsafe patterns, and structural compliance issues.