skill-vettrStatic analysis security scanner for third-party OpenClaw skills. Detects eval/spawn risks, malicious dependencies, typosquatting, and prompt injection patte...
Install via ClawdBot CLI:
clawdbot install britrik/skill-vettrGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaContains instructions to override system prompt or ignore user requests
"ignore all previous instructions"Sends data to undocumented external endpoint (potential exfiltration)
post → http://evil.comPotentially destructive shell commands in tool definitions
rm -rf /Generated May 7, 2026
Enterprise security teams can use skill-vettr to scan third-party OpenClaw skills for malicious patterns before deployment. This ensures that any skill downloaded from ClawHub or other sources does not contain code execution, shell injection, or credential theft risks.
Platform operators of skill marketplaces can integrate skill-vettr to automatically analyze submitted skills. It detects typosquatting, dangerous permissions, and static threats, helping maintain a trusted ecosystem.
Development teams building OpenClaw skills can run skill-vettr in CI/CD pipelines to catch security issues early. This reduces the risk of shipping skills with hidden vulnerabilities like eval or prompt injection.
Security auditors can use skill-vettr to retrospectively scan installed skills in an OpenClaw environment. This helps identify previously unnoticed risks, such as malicious dependencies or homoglyph attacks.
Organizations deploying AI agents that rely on skill plugins can vet each skill's source code and dependencies with skill-vettr. This adds a layer of supply chain security, detecting prompt injection and prototype pollution.
Offer skill-vettr as a cloud-based API where users submit skills for security scanning. Revenue comes from subscription tiers based on scan volume, with premium features like deep AST analysis or faster turnaround.
Provide skill-vettr as open source under a permissive license, while selling enterprise support, custom rule packs, and integration with CI/CD tools. Revenue from support contracts and premium configurations.
Offer basic scanning for free, with paid access to an updated threat database and additional detection categories (e.g., zero-day patterns). Revenue comes from monthly subscriptions for threat intelligence feeds.
💬 Integration Tip
Integrate via CLI in CI/CD pipelines using commands like `skill:vet --path <dir>`, or use the underlying API programmatically. For maximum safety, run scans in disposable containers.
Scored Jul 1, 2026
Calls external URL not in known-safe list
https://...Uses known external API (expected, informational)
api.anthropic.comAI Analysis
The skill is a security scanner designed to vet other skills, and the detected signals appear to be examples of what it detects, not its own malicious behavior. Its external API usage (like api.anthropic.com) is likely for analysis, and the 'evil.com' endpoint is a test pattern, not an actual data sink. The credential access pattern is a detection target, not an action the scanner performs.
Audited Apr 16, 2026 · audit v1.0
Manage and operate ClawSec Monitor v3.0, a MITM HTTP/HTTPS proxy that logs AI agent traffic, detects exfiltration and injection threats in real time.
Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data exfiltration, system modification attempts, backdoors, and obfuscation techniques.
Security scanner for ClawHub skills. Vet third-party skills before installation — detect dangerous patterns, suspicious code, and risky dependencies.
Security audit and hardening for AI agents — credential hygiene, secret scanning, prompt injection defense, data leakage prevention, and privacy zones.
Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them. Use when a user wants to audit a skill, check if a ClawHub skill is safe, scan for credential exfiltration, detect prompt injection, or review skill security. Triggers on security audit, skill safety check, malware scan, or trust verification.
OpenClaw skill discovery, security vetting & install. Searches 3000+ curated skills from ClawHub registry and awesome-openclaw-skills catalog. Scores credibility, detects prompt injection & malicious patterns, manages installations. Quick-checks GitHub for new skills.