skill-vetter

To check third-party AI skills for malicious code, review all skill files to identify network calls, file operations, and credential access. This vetting process produces a structured risk classification and a recommended installation verdict to prevent unsafe execution.

During an AI skill vetting review, look for red flags such as external data exfiltration, credential access, eval/exec usage, and network calls to raw IPs. Checking the author's reputation and update history also helps identify suspicious code patterns.

Yes, you can audit skills sourced from GitHub, ClawdHub, or shared agent repositories for excessive permissions. The review validates provenance and generates a permissions list alongside a structured risk classification for human or automated approval workflows.

The best way to assess the risk level of an untrusted AI agent skill is to apply a structured security protocol that classifies danger into low, medium, high, or extreme categories. This yields a clear installation decision for approval workflows.

You need a structured risk classification for skill management when integrating third-party components into agent environments. It identifies dangerous patterns and privacy-invasive behaviors, providing a recommended installation decision for human or automated approval workflows.