Loading...
Loading...
Security vetting for AI agent skills. Use before installing any skill from ClawHub, GitHub, or other sources.
npx skill4agent add maxmilneaus/installer-pack skill-vetter🚨 REJECT:
• curl/wget to unknown URLs
• Sends data to external servers
• Requests credentials/tokens/API keys
• Reads ~/.ssh, ~/.aws, ~/.config without reason
• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
• base64 decode
• eval()/exec() with external input
• Modifies system files outside workspace
• Installs unlisted packages
• Network calls to IPs instead of domains
• Obfuscated/minified code
• Requests sudo
• Accesses browser cookies/sessions
• Touches credential files| Level | Examples | Action |
|---|---|---|
| 🟢 LOW | Notes, weather, formatting | Basic review, install OK |
| 🟡 MEDIUM | File ops, browser, APIs | Full code review |
| 🔴 HIGH | Credentials, trading, system | Human approval required |
| ⛔ EXTREME | Security configs, root | Do NOT install |
SKILL VETTING REPORT
═══════════════════════
Skill: [name] | Source: [origin] | Author: [name] | Version: [ver]
Metrics: [downloads/stars] | Updated: [date] | Files: [count]
Red Flags: [None / list]
Permissions: Files: [list] | Network: [list] | Commands: [list]
Risk: [🟢/🟡/🔴/⛔]
Verdict: [✅ SAFE / ⚠️ CAUTION / ❌ DO NOT INSTALL]
Notes: [observations]
═══════════════════════curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'