About clawhub-skill-vetting
clawhub-skill-vetting is a security-focused skill for assessing ClawHub skills before installation. It guides source and code review, permission checks, risk reporting, and a go/no-go recommendation.
Key features
- 01Check author and community signals
- 02Review code for security risks
- 03Assess file, command, and network permissions
- 04Look for suspicious recent activity
- 05Produce a risk report and recommendation
Use cases
- 01Vet a ClawHub skill before installation
- 02Identify unsafe code or excessive permissions
- 03Decide whether to install in a sandbox
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/clawhub-skill-vettingin Claude Code to confirm it loaded.
Bundled filesREADME.mdreferences/vetting-guide.md
Details
From the project READMEClawHub Skill Vetting
Overview
Apply a strict, security‑first vetting workflow before installing any ClawHub skill. Prioritize code review, permission scope, domain listing, and risk scoring.
Workflow
- Source check — author reputation, stars/downloads, last update, reviews.
- Code review (MANDATORY) — scan all files for exfiltration, secrets access,
eval/exec, obfuscation. - Permission scope — files, commands, network; confirm minimal scope.
- Recent activity — detect suspicious bursts.
- Community check — Discord/GitHub Discussions.
- Install safely — sandbox + inspect permissions.
Reference
Use references/vetting-guide.md for the full checklist, commands, red flags, confidence scoring, and report template.
Output expectations
- Produce the SKILL VETTING REPORT format.
- Provide a go/no‑go recommendation with reasons.
- If unclear, recommend sandbox install only or reject.
- Call out any red flags explicitly.
- Include a confidence score and threshold.
Comments
Markdown supported