OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add skills.volces.com/skill-vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
npx skills add skills.volces.com/skill-vetter
Security-first vetting protocol for AI agent skills. Never install a skill without vetting it first.
Read ALL files in the skill. Check for these RED FLAGS:
| Risk Level | Examples | Action |
|---|---|---|
| š¢ LOW | Notes, weather, formatting | Basic review, install OK |
| š” MEDIUM | File ops, browser, APIs | Full code review required |
| š“ HIGH | Credentials, trading, system | Human approval required |
| ā EXTREME | Security configs, root access | Do NOT install |
After vetting, produce this report:
For GitHub-hosted skills:
Paranoia is a feature. šš¦
Evaluate:
- [ ] What files does it need to read?
- [ ] What files does it need to write?
- [ ] What commands does it run?
- [ ] Does it need network access? To where?
- [ ] Is the scope minimal for its stated purpose?SKILL VETTING REPORT
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
Skill: [name]
Source: [ClawdHub / GitHub / other]
Author: [username]
Version: [version]
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
METRICS:
ā¢ Downloads/Stars: [count]
ā¢ Last Updated: [date]
ā¢ Files Reviewed: [count]
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
RED FLAGS: [None / List them]
PERMISSIONS NEEDED:
ā¢ Files: [list or "None"]
ā¢ Network: [list or "None"]
ā¢ Commands: [list or "None"]
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
RISK LEVEL: [š¢ LOW / š” MEDIUM / š“ HIGH / ā EXTREME]
VERDICT: [ā
SAFE TO INSTALL / ā ļø INSTALL WITH CAUTION / ā DO NOT INSTALL]
NOTES: [Any observations]
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā# Check repo stats
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'
# List skill files
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'
# Fetch and review SKILL.md
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"