Evaluate AI agent skills for malicious code and excessive permissions.
npx skills add https://github.com/zeroix07/mcp-skill-agent --skill skill-vetter-zeroix07
Please help me install this Agent Skill. Skill: skill-vetter Source: https://github.com/zeroix07/mcp-skill-agent/tree/main/skill-vetter Command: npx skills add https://github.com/zeroix07/mcp-skill-agent --skill skill-vetter-zeroix07
Installing unvetted AI agent skills from untrusted sources like GitHub or ClawdHub can introduce critical security risks including malware, credential theft, and unauthorized system access. This Skill eliminates that risk by providing a standardized, security-first vetting protocol to evaluate any skill before installation.
Use the skill-vetter protocol to evaluate the 'new-data-skill' from GitHub before installing it on your system.
High-intent search queries and answers about installing and using this skill.
To check an AI agent skill for malware before installing it, apply a security-first vetting protocol that scans all scripts and configuration files for malicious code, unauthorized data access, and excessive permission requests. This process generates a standardized risk classification report.
Skill vetting is a security protocol to evaluate third-party AI agent skills for malicious code and excessive permission requests before installation. You need to review agent permissions when sourcing skills from untrusted repositories like GitHub or ClawdHub to prevent unauthorized system access.
To vet a GitHub-hosted AI skill for security red flags, use pre-built commands to fetch repository stats and file lists, then perform a mandatory code review covering source credibility, permission scope, and malicious code patterns like credential theft. This yields a clear safe or do not install verdict.
Yes, the skill vetting protocol works with third-party repositories beyond GitHub, including ClawdHub and other sources. It evaluates all skill files such as scripts, configuration, and documentation to detect unauthorized data exfiltration and classify installation risk consistently.
Yes, you can get a standardized risk report after evaluating an AI agent skill. The vetting protocol generates an easy-to-read report detailing the risk level, installation verdict, and specific flagged issues to inform your decision-making before installation.
ThrookieInspect AI skill sources, review code, and classify risks before installation.
fishyerReview AI agent skill source, code, and permissions to classify risk levels.
ArianHobson333Automate source code security scanning for vulnerabilities, CVEs, and hardcoded secrets.
JNZaderDetect credential theft and other security risks in AI skill definitions before installation.
