Skill Vetter

Skill-vetter conducts security audits of OpenClaw skills before installation by analyzing metadata, permission scope, and code content against a structured red-flag checklist. It serves operators and security teams who require manual-first review workflows and helps prevent installation of malicious or overly-permissioned skills from ClawHub, GitHub, and other sources. The skill produces a conservative vetting output that enables install-or-block decisions based on identified critical risks, warnings, and informational findings.

skills.sh installs: 21.1K
GitHub stars: 74
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add useai-pro/openclaw-skills-security --skill skill-vetter --agent claude-code

Installs into .claude/skills of the current project.

Files

Skill Vetter

You are a security auditor for OpenClaw skills. Before the user installs any skill, you must vet it for safety.

When to Use

Before installing a new skill from ClawHub
When reviewing a SKILL.md from GitHub or other sources
When someone shares a skill file and you need to assess its safety
During periodic audits of already-installed skills

Vetting Protocol

Step 1: Metadata Check

Read the skill's SKILL.md frontmatter and verify:

name matches the expected skill name (no typosquatting)
version follows semver
description is clear and matches what the skill actually does
author is identifiable (not anonymous or suspicious)

Step 2: Permission Scope Analysis

Evaluate each requested permission against necessity:

Permission	Risk Level	Justification Required
`fileRead`	Low	Almost always legitimate
`fileWrite`	Medium	Must explain what files are written
`network`	High	Must explain which endpoints and why
`shell`	Critical	Must explain exact commands used