skill-vetter

Follow a four-step vetting protocol: verify the source and author reputation, read every file for red flags like external network calls or credential access, evaluate the permission scope, then assign a risk level from LOW to EXTREME before deciding.

Reject skills that curl or wget unknown URLs, send data to external servers, request credentials or API keys, read ~/.ssh or ~/.aws without reason, use base64 decoding or eval on external input, contain obfuscated code, or request sudo permissions.

Use the GitHub API to check repo stars, forks, and last update date, list the skill's files, then fetch and read the SKILL.md and all other files. High-star repos and known authors warrant moderate scrutiny; unknown sources require maximum scrutiny.

Human approval is required for HIGH risk skills involving credentials, trading, or system access, and for any skill requesting credentials regardless of source. EXTREME risk skills touching security configs or root access should not be installed at all.

Manual vetting depends on the reviewer's ability to spot obfuscated or cleverly hidden malicious code, and reputable sources can still be compromised. It reduces risk but cannot guarantee a skill is completely safe.