skill-vetter

To audit an OpenClaw skill for security risks, analyze its SKILL.md file to evaluate metadata, permissions, and content for malicious patterns or excessive access. This pre-install security audit flags unsafe skills.

Typosquatting in skill marketplaces is the use of deceptive naming conventions to imitate legitimate skills. You detect it by analyzing the skill's metadata naming patterns to identify and block these imposter skills before installation.

Yes, you can check for prompt injection vulnerabilities by analyzing the skill's instructions and scripts. The security audit identifies malicious patterns within the content, flagging potential risks before you install the skill.

Skill vetting does identify excessive permissions in OpenClaw tools by analyzing the skill's requested access rights during the pre-install audit. It flags any permissions that exceed expected operational requirements.

The best way to verify an unfamiliar skill is to perform a comprehensive security check on its SKILL.md file. This analyzes metadata, permissions, and content to ensure it adheres to best practices and poses no risk to your environment.

You should run a risk assessment on a new skill prior to installation, especially when sourcing from an unfamiliar publisher. This pre-install audit ensures a secure operational environment by blocking unsafe or misconfigured tools.