skill-vetter-zh

To check an AI agent skill for malware before installation, perform a pre-installation security audit that scans for dangerous code patterns, excessive permission scopes, and suspicious behaviors to identify malicious risks.

Skill vetting is a security-first protocol that reviews source code and permissions to classify a skill's risk level. Risk assessment works by evaluating file, network, and command permissions to assign Low, Medium, High, or Critical ratings.

To review GitHub AI skills for suspicious behaviors, systematically inspect the source code for specific red flags and data exfiltration attempts, then assess the required file, network, and command permissions to determine if scopes are excessive.

Yes, you can use this security review protocol on skills sourced from ClawHub, GitHub, or other origins. It systematically checks for dangerous code patterns and suspicious activities across various sources to ensure a safer AI environment.

Code inspection for detecting malicious AI skills is limited to identifying specific dangerous code patterns and excessive permission scopes. It relies on systematically checking for known red flags and may not detect novel or obfuscated malware techniques.

You need to perform a pre-installation security audit on AI agent skills whenever you source new skills from GitHub, ClawHub, or other origins to prevent deploying malicious code and mitigate risks associated with data exfiltration attempts.