clawhub-skill-vetting
hugomrtz/skill-vetting-clawhub
Vet ClawHub skills before installation with security-first code review and risk scoring.
What is clawhub-skill-vetting?
Apply a strict vetting workflow to evaluate ClawHub skill trustworthiness before installing. Use this when assessing skill safety, reviewing code for exfiltration or malicious patterns, or when a skill's integrity is in question.
- Source verification: check author reputation, stars, downloads, and last update
- Mandatory code review: scan for exfiltration, secrets access, eval/exec, and obfuscation
- Permission scope analysis: confirm minimal file, command, and network access
- Recent activity detection: identify suspicious installation or update bursts
- Community feedback check: review Discord and GitHub Discussions for warnings
- Sandbox installation guidance: safe testing before full deployment
How to install clawhub-skill-vetting
npx skills add https://github.com/hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vettingHow to use clawhub-skill-vetting
- 1.Request a vetting report for the skill in question, providing the skill name or repository URL
- 2.Review the source check results: author reputation, version history, and community signals
- 3.Examine the mandatory code review findings for red flags like exfiltration or obfuscation
- 4.Assess the permission scope to confirm it aligns with the skill's stated purpose
- 5.Check recent activity for suspicious patterns or unexpected changes
- 6.Consult the community feedback section for user reports or warnings
- 7.Make a go/no-go decision based on the confidence score and risk assessment
- 8.If uncertain, proceed with sandbox installation only before full deployment
Use cases
- Evaluate an unknown or third-party ClawHub skill before installing in production
- Audit a skill with suspicious code patterns or unclear permissions
- Review a skill with limited community history or recent major changes
- Assess whether a skill requires network access or file system permissions
- Determine if a skill should be sandboxed or rejected entirely
- ClawHub/OpenClaw users installing community skills
- Security-conscious developers evaluating third-party code
- Teams managing skill deployments across multiple agents
- Anyone installing skills from unfamiliar or new authors
clawhub-skill-vetting FAQ
Red flags include: exfiltration code, hardcoded secrets, eval/exec usage, obfuscation, excessive permissions, suspicious recent activity, or negative community feedback. Any critical red flag warrants rejection or sandbox-only installation.
Yes, but only in a sandbox environment with restricted permissions. Never install an unvetted skill with full system access. Re-evaluate after further investigation or community feedback.
The confidence score reflects the reliability of the vetting assessment (0–100%). Higher scores indicate more thorough review data. Use the score to decide whether to trust the recommendation or request additional investigation.
Search the ClawHub Discord server and GitHub Discussions for the skill name or author. Look for user reports, issues, or warnings. Lack of community presence may indicate a new or unpopular skill requiring extra caution.
Reject or sandbox-only install. Review the code to understand why those permissions are needed. If the purpose doesn't justify the scope, the skill is not trustworthy.
Full instructions (SKILL.md)
Source of truth, from hugomrtz/skill-vetting-clawhub.
name: clawhub-skill-vetting description: Vet ClawHub skills before installation. Use when the user asks about evaluating, auditing, or safely installing OpenClaw/ClawHub skills, or when a skill’s trustworthiness is in question.
ClawHub Skill Vetting
Overview
Apply a strict, security‑first vetting workflow before installing any ClawHub skill. Prioritize code review, permission scope, domain listing, and risk scoring.
Workflow
- Source check — author reputation, stars/downloads, last update, reviews.
- Code review (MANDATORY) — scan all files for exfiltration, secrets access,
eval/exec, obfuscation. - Permission scope — files, commands, network; confirm minimal scope.
- Recent activity — detect suspicious bursts.
- Community check — Discord/GitHub Discussions.
- Install safely — sandbox + inspect permissions.
Reference
Use references/vetting-guide.md for the full checklist, commands, red flags, confidence scoring, and report template.
Output expectations
- Produce the SKILL VETTING REPORT format.
- Provide a go/no‑go recommendation with reasons.
- If unclear, recommend sandbox install only or reject.
- Call out any red flags explicitly.
- Include a confidence score and threshold.
Related skills
More from hugomrtz/skill-vetting-clawhub and the wider catalog.
create-evlog-adapter
Create a new built-in evlog adapter to send wide events to an external observability platform. Use when adding a new drain adapter (e.g., for Datadog, Sentry, Loki, Elasticsearch, etc.) to the evlog package. Covers source code, build config, package exports, tests, and all documentation.
create-evlog-enricher
Create a new built-in evlog enricher to add derived context to wide events. Use when adding a new enricher (e.g., for deployment metadata, tenant context, feature flags, etc.) to the evlog package. Covers source code, tests, and all documentation.
detect-ai
Analyze text to detect if it was written by AI. Returns a score from 0-100 with detailed metrics. Use when checking content before publishing or submitting.
humanize
Transform AI-generated text into natural, human-like content that bypasses AI detectors.
shadcn-svelte
Manages shadcn-svelte components and projects — adding, updating, fixing, debugging, styling, and composing UI. Provides project context, component docs, and usage examples. Applies when working with shadcn-svelte, the CLI, design-system presets, or any project with a components.json file. Also triggers for "shadcn-svelte init", "add component", or registry URLs.
nushell-pro
|