Agent skill · security · sundial-org
skill-vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
Why this skill is useful
Adds a comprehensive security vetting protocol with specific checks and commands that enhance the AI's ability to assess skill safety.
What it needs
Requires jq installed locally. About 2k tokens when loaded. Last updated 2026-03-07. 639 stars on the source repository.
What this skill does
Skill Vetter 🔒 Security-first vetting protocol for AI agent skills. Never install a skill without vetting it first. When to Use Before installing any skill from ClawdHub Before running skills from GitHub repos When evaluating skills shared by other agents Anytime you're asked to install unknown code Vetting Protocol Step 1: Source Check Step 2: Code Review (MANDATORY) Read ALL files in the skill. Check for these RED FLAGS: Step 3: Permission Scope Step 4: Risk Classification Risk Level Examples Action ------------ ---------- -------- 🟢 LOW Notes, weather, formatting Basic review, install OK 🟡 MEDIUM File ops, browser, APIs Full code review required 🔴 HIGH Credentials, trading, system Human approval required ⛔ EXTREME Security configs, root access Do NOT install Output Format After vetting, produce this report: Quick Vet Commands For GitHub-hosted skills: Trust Hierarchy 1. Official OpenClaw skills → Lower scrutiny (still review) 2. High-star repos (1000+) → Moderate scrutiny 3. Known authors → Moderate scrutiny 4. New/unknown sources → Maximum scrutiny 5. Skills requesting credentials → Human approval always Remember No skill is worth compromising security When in doubt, don't install Ask your human for high-risk decisions Document what you vet for future reference --- Paranoia is a feature. 🔒🦀
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sundial-org/skill-vetter