skill-vettr

Static analysis of OpenClaw skills identifies and blocks unsafe code before installation by scanning JS/TS files, dependencies, and YAML frontmatter. It detects risky patterns like eval and Function constructors to prevent malicious code execution.

Vetting dependencies and metadata for typosquatting involves analyzing package names against configurable allowlists and blocked author lists. This risk-based workflow audits network calls and checks YAML frontmatter to block dangerous permissions before provisioning.

Yes, you can enforce a custom allowlist for network calls when vetting untrusted skills. The vetting workflow supports configurable allowlists and blocked authors to audit network requests and assign risk scores to skills from untrusted sources.

Static analysis vetting for skill security is the process of inspecting code and dependencies for threats without executing them. You need it when provisioning skills from ClawHub or untrusted sources into a production environment to block unsafe installations.

Limitations of static analysis for JS/TS code include its inability to detect runtime threats that only execute dynamically. It focuses on identifying static risky patterns like eval and Function constructors, meaning obfuscated runtime attacks may bypass the vetting workflow.