About this skill

Problem: Trust gaps before Skill installation

In AI Agent workflows, a Skill is not only a prompt fragment; it may also introduce tool calls, external links, environment variable access, and execution logic. Skills from ClawdHub, GitHub, or third-party repositories can look functionally similar, while their permission boundaries, triggers, and side effects differ significantly. Installing first and inspecting later can let an apparently harmless skill enter the execution path, exposing credentials, broadening access, or leaving hard-to-audit call traces.

How it works: move review before installation

Skill Security Vetting moves security checks ahead of the install action. It examines triggers, descriptions, file manifests, tool dependencies, and permission requests in a structured way, with focus on:

Risk markers: requests for broad authorization, hidden triggers, access to sensitive directories or credentials
Permission scope: whether network access, file writes, system commands, or third-party API calls exceed the stated need
Suspicious patterns: vague descriptions, abnormal install scripts, obfuscated instructions, or behavior inconsistent with declared functionality

This produces a readable risk summary for engineers to decide whether to reject, restrict permissions, or proceed.

Boundaries

This skill is for pre-installation review and does not replace vulnerability scanning, dependency audits, or runtime sandboxing. For fully closed-source, dynamically loaded, or externally dependent Skills, combine it with source review and least-privilege controls.