Clawhub Skill Vetting

This is the workflow you want before installing anything from ClawHub that you didn't write yourself. It walks you through a mandatory six-step vetting process: checking author reputation, reviewing all code for exfiltration patterns and suspicious eval calls, validating permission scope, spotting unusual activity bursts, checking community sentiment, and sandboxing the install. The output is a structured report with red flags, a confidence score, and a clear go/no-go recommendation. Honestly, the fact that this needs to exist tells you everything about the current state of third-party skill ecosystems. Use it whenever you're evaluating a skill or when someone asks about safe installation practices.

skills.sh installs: 1.6K
GitHub stars: 5
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting --agent claude-code

Installs into .claude/skills of the current project.

Files

ClawHub Skill Vetting

Overview

Apply a strict, security‑first vetting workflow before installing any ClawHub skill. Prioritize code review, permission scope, domain listing, and risk scoring.

Workflow

Source check — author reputation, stars/downloads, last update, reviews.
Code review (MANDATORY) — scan all files for exfiltration, secrets access, eval/exec, obfuscation.
Permission scope — files, commands, network; confirm minimal scope.
Recent activity — detect suspicious bursts.
Community check — Discord/GitHub Discussions.
Install safely — sandbox + inspect permissions.