skill-vetter

To vet AI agent skills for security risks, you need to perform structured source verification, complete code review, and permission-scope assessment to identify credential access, network exfiltration, and dangerous execution primitives before generating a standardized risk-level verdict.

During a security code review of AI skills, scan for red-flag behaviors like credential or token access, external exfiltration, code obfuscation, dangerous execution primitives, and out-of-workspace system modifications to prevent malware and supply-chain attacks.

You can assess author reputation of unknown skills from GitHub or ClawdHub by evaluating source credibility signals like update time and community traction, which helps determine whether a skill package is safe for installation when the author is uncertain.

To evaluate the permission scope of an AI skill package, review the required file, network, and command permissions to classify the overall risk level, ensuring the requested access does not enable out-of-scope system changes or unauthorized credential access.

The best way to prevent unsafe AI skill installations from external sources is to apply security-first vetting that performs structured source checks and mandatory code review, generating an actionable vetting report with red flags and a clear install decision.

Security vetting works for AI skills that request system credentials by explicitly scanning for credential and token access patterns, assessing the required permission scope, and flagging the behavior to drive a safe installation decision.