openclaw-skill-vetterSecurity vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification L...
Install via ClawdBot CLI:
clawdbot install donovanpankratz-del/openclaw-skill-vetterGrade Excellent — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaSends data to undocumented external endpoint (potential exfiltration)
POST → https://evil.com/stealPotentially destructive shell commands in tool definitions
eval(Calls external URL not in known-safe list
https://clawhub.comGenerated Mar 20, 2026
Large organizations deploying AI agents across departments use this skill to vet third-party skills before installation, ensuring compliance with internal security policies and preventing credential theft or data exfiltration. It helps maintain audit trails with structured reports for regulatory requirements.
Skill marketplaces like ClawHub integrate this vetting protocol to automatically scan new skill submissions, flagging high-risk code such as obfuscated scripts or unauthorized network calls. This reduces manual review efforts and enhances platform trustworthiness for users.
Independent consultants use this skill to evaluate skills for clients, providing detailed risk assessments before deployment in custom AI agent setups. It ensures safe integration of external tools while adhering to least privilege principles.
Training programs and workshops teach students or professionals how to use this skill as part of AI security best practices, using its checklist and red flag detection to build hands-on experience in secure skill evaluation.
Open source maintainers vet community-contributed skills for their AI agent projects, using the protocol to identify malicious code and ensure only safe, well-reviewed skills are included in public repositories.
Offer a free basic version for individual users with limited features, while charging enterprises for advanced analytics, automated scanning, and integration with CI/CD pipelines. Revenue comes from subscription tiers based on usage volume.
Partner with skill marketplaces like ClawHub to provide vetting as a built-in service, charging a fee per skill scan or a percentage of marketplace transactions. This model leverages platform trust and scales with user growth.
Provide bespoke vetting solutions tailored to specific industries, such as finance or healthcare, with custom risk classifications and compliance reporting. Revenue is generated through project-based contracts and ongoing support services.
💬 Integration Tip
Integrate this skill into automated workflows using its CLI commands for GitHub or ClawHub, and customize the vetting checklist to align with organizational security policies for consistent reviews.
Scored Apr 16, 2026
Uses known external API (expected, informational)
api.github.comAI Analysis
This skill is a security vetting tool designed to analyze other skills; its instructions are explicit security checks and warnings. The external calls (e.g., clawhub.com, api.github.com) are consistent with its stated purpose of source validation and do not constitute unauthorized data exfiltration or credential harvesting.
Audited Apr 16, 2026 · audit v1.0
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Audit a user's current AI tool stack. Score each tool by ROI, identify redundancies, gaps, and upgrade opportunities. Produces a structured report with score...
Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.
Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.
Solve CAPTCHAs using 2Captcha service via CLI. Use for bypassing captchas during web automation, account creation, or form submission.
Detect anomalies and outliers in construction data: unusual costs, schedule variances, productivity spikes. Statistical and ML-based detection methods.