chen-skill-vetterSecurity-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Install via ClawdBot CLI:
clawdbot install cs995279497-byte/chen-skill-vetterGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
eval(Uses known external API (expected, informational)
api.github.comAudited Apr 17, 2026 · audit v1.0
Generated May 10, 2026
An AI agent is asked to install a new skill from a low-star GitHub repository. The agent uses the Skill Vetter to check the source reputation, review code for red flags, and assess permissions before deciding to install.
In a marketplace like ClawdHub, agents share skills. Before installing a skill shared by another agent, the Skill Vetter runs a full security check, including code review and risk classification, to prevent malicious skills from spreading.
A skill requests access to ~/.ssh and ~/.aws directories. The Skill Vetter flags this as a HIGH risk, requiring human approval, and prevents automatic installation, thus protecting sensitive credentials.
A DevOps team integrates AI agents into CI/CD. Before deploying a skill that automates infrastructure changes, the Skill Vetter checks for network calls to unknown IPs and commands that modify system files, ensuring pipeline security.
A financial AI agent considers installing a skill that claims to optimize trades. The Skill Vetter scans for obfuscated code and network calls, and classifies it as HIGH risk, triggering manual review to prevent financial loss.
Offer automated skill vetting as a subscription service for platforms like ClawdHub, ensuring all skills uploaded pass security checks. Revenue comes from platform licensing fees per skill vetted.
Provide an API endpoint that enterprises integrate into their internal AI agent workflows to vet skills automatically. Revenue is generated via usage-based pricing per API call.
For skills classified as HIGH or EXTREME risk, offer a human-in-the-loop auditing service where security experts perform deep code reviews. Revenue comes from per-skill audit fees.
💬 Integration Tip
Integrate the Skill Vetter as a pre-install hook in your agent's workflow—call it before any skill installation command to ensure all checks are automated.
Scored May 10, 2026
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.
Analyze and classify agent skills for safety using local evaluation. Optionally produce a signed attestation of the vetting result.
Detect 500+ types of hardcoded secrets (API keys, credentials, tokens) before they leak into git. Wraps GitGuardian's ggshield CLI.
Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.