skill-vetter

Name: skill-vetter
Availability: InStock
Author: wtgoku-create

Review AI agent skill packages for security risks and generate risk-level verdicts.

1|Updated May 13, 2026

Search Tags:#code review #permissions #ai agents #risk assessment #supply-chain #security vetting #malware prevention

Ready to run

npx skills add https://github.com/wtgoku-create/PopiStudio --skill skill-vetter-wtgoku-create

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skill-vetter
Source: https://github.com/wtgoku-create/PopiStudio/tree/main/SKILLs/skill-vetter
Command: npx skills add https://github.com/wtgoku-create/PopiStudio --skill skill-vetter-wtgoku-create

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents unsafe or malicious AI skill code from being installed or executed by screening skills before they run.

Core Features & Use Cases

Source verification: Assesses where the skill comes from (e.g., ClawdHub, GitHub, or other sources) and evaluates author credibility signals like update time and community traction.
Mandatory security-focused code review: Checks the full skill contents for high-risk patterns such as credential access, suspicious network behavior, obfuscation, dangerous execution, or out-of-scope system changes.
Permission and risk scoping: Reviews required file/network/command permissions and classifies the overall risk level to drive the install decision.
Actionable vetting report output: Produces a standardized report with red flags, permissions needed, and a clear verdict.

Quick Start

Vet a newly shared or downloaded skill by asking the AI to produce a security vetting report following the Skill Vetter protocol.

Frequently Asked Questions about skill-vetter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I vet AI agent skills for security risks before installation?▼

To vet AI agent skills for security risks, you need to perform structured source verification, complete code review, and permission-scope assessment to identify credential access, network exfiltration, and dangerous execution primitives before generating a standardized risk-level verdict.

What red flags should I look for during a security code review of AI skills?▼

During a security code review of AI skills, scan for red-flag behaviors like credential or token access, external exfiltration, code obfuscation, dangerous execution primitives, and out-of-workspace system modifications to prevent malware and supply-chain attacks.

Can I assess the author reputation of unknown skills from GitHub or ClawdHub?▼

You can assess author reputation of unknown skills from GitHub or ClawdHub by evaluating source credibility signals like update time and community traction, which helps determine whether a skill package is safe for installation when the author is uncertain.

How do I evaluate the permission scope of an AI skill package?▼

To evaluate the permission scope of an AI skill package, review the required file, network, and command permissions to classify the overall risk level, ensuring the requested access does not enable out-of-scope system changes or unauthorized credential access.

What is the best way to prevent unsafe AI skill installations from external sources?▼

The best way to prevent unsafe AI skill installations from external sources is to apply security-first vetting that performs structured source checks and mandatory code review, generating an actionable vetting report with red flags and a clear install decision.

Does security vetting work for AI skills that request system credentials?▼

Security vetting works for AI skills that request system credentials by explicitly scanning for credential and token access patterns, assessing the required permission scope, and flagging the behavior to drive a safe installation decision.