---

Skill Vetter v2#

Skill Vetter v2 is a verification-guided review skill for inspecting Claude/OpenClaw skill packages before use or publication.

It helps identify risky instructions, unclear authority boundaries, hidden assumptions, undeclared egress, provenance gaps, and claims that exceed evidence.

This skill does not itself perform cryptographic verification, emit Settlement Attestation Receipts, or prove that a skill is safe. It is a structured review workflow.

For actual receipt verification, use SettlementWitness or DefaultVerifier MCP verify_receipt.

Category: verifiability-guided workflow skill.

Boundary: Skill Vetter v2 reviews claims and risk signals; it does not certify, approve, execute, or cryptographically verify artifacts.

---

Analyze skills before installation or use. Classify capabilities, risks, and trust dependencies with structured local review. Optionally verify the completed report with SettlementWitness.

This is a packaged vetting skill, not a thin wrapper. It preserves local inspection as the primary decision path and adds an optional verification layer for auditability.

Data handling and trust#

This skill defines a local review workflow with an optional verification step for the final report.

• Perform capability analysis and risk classification locally
• Do not send secrets, credentials, private keys, seed phrases, personal data, or full private repositories to any external service
• If optional verification is used, send only the minimum structured task data needed to validate the report
• Verification does not decide whether a skill is safe to install; it only validates that the vetting report matches the stated evaluation spec
• Identity is optional; no wallet access, account access, or credentials are required

Core Principle#

Never outsource the safety decision.

External systems may help verify that a report was produced correctly, but the actual judgment about whether a skill should be trusted remains local and reviewable.

Quick Reference#

SituationActionNew skill from unknown sourceRun full local vetting workflowSkill asks for secrets or credentialsEscalate risk immediatelySkill writes outside workspaceMark as high risk unless clearly justifiedSkill calls external servicesClassify trust dependency and data exposureSkill contains obfuscation or hidden executionMark unsafeFinal report is completeOptionally verify the report structure and verdict consistencyVerification returns PASSAttach receipt metadata to the reportVerification returns FAILRe-check findings and correct the reportVerification returns INDETERMINATEHold for manual review; do not treat as verified

What This Skill Does#

Skill Vetter v2 evaluates a target skill across four dimensions:

1. Purpose and scope What the skill claims to do, and whether its requested capabilities match that purpose.

2. Install-time behavior File writes, package installs, hooks, system changes, or bootstrap modifications.

3. Runtime behavior Commands, file access, network access, external APIs, tool usage, and data handling.

4. Trust dependency Whether the skill depends on transparent and reviewable systems, or on opaque and unverifiable services.

Core Execution Loop#

1. Inspect the skill package locally

   • SKILL.md
   • README.md and references
   • scripts, hooks, assets, templates
   • metadata and install surface

2. Identify declared and implied capabilities

   • file reads and writes
   • command execution
   • package installation
   • network or API usage
   • handling of credentials, memory, or sensitive files

3. Evaluate risk

   • install-time risk
   • runtime risk
   • data exposure risk
   • trust dependency risk

4. Generate a structured report

5. Optional: verify the completed report

   • define a deterministic verification spec for the report structure and verdict logic
   • run verification only on the minimal structured report payload
   • attach receipt metadata only when verification passes

Risk Evaluation Categories#

Install-Time Risk#

Review for:

• file writes outside the workspace
• package installs or dependency changes
• shell profile or system configuration changes
• hook registration or startup injection
• hidden setup steps not stated in the docs

Runtime Risk#

Review for:

• external API calls
• arbitrary command execution
• broad file system access
• credential discovery or token handling
• browser/session access
• transmission of user data or memory files

Trust Dependency#

Classify the skill's external dependencies:

• none — local-only behavior, no external trust dependency
• transparent — external dependency is narrow, explicit, and independently understandable
• opaque — external dependency is broad, hidden, unverifiable, or requests sensitive data

Red Flags#

Reject or escalate immediately if you find:

• requests for credentials, API keys, seed phrases, or private keys
• access to secret stores or credential directories without a clear need
• obfuscated or encoded execution logic intended to hide behavior
• silent network transmission of prompts, memory, or workspace files
• writes outside expected directories without a clear reason
• privilege escalation or system-level modification
• unexplained background processes, persistence, or surveillance behavior

Output Format#

json

{
  "skill_name": "...",
  "purpose": "...",
  "source": "clawhub | github | local | other",
  "capabilities": ["..."],
  "install_risk": "low | medium | high | extreme",
  "runtime_risk": "low | medium | high | extreme",
  "trust_dependency": "none | transparent | opaque",
  "warnings": ["..."],
  "recommendations": ["..."],
  "verdict": "safe | caution | unsafe",
  "verified": false,
  "verification": {
    "status": "not_run | pass | fail | indeterminate",
    "receipt_id": null,
    "notes": ""
  }
}

---

Example Usage#

Input (Skill to Review)#

json

{
  "skill_name": "example-email-sender",
  "source": "github",
  "description": "Sends automated emails using an external API",
  "files": ["SKILL.md", "scripts/send-email.sh"]
}

Output (Vetting Report)#

json

{
  "skill_name": "example-email-sender",
  "purpose": "Send automated emails via external API",
  "source": "github",
  "capabilities": [
    "network access",
    "external API calls",
    "file read/write"
  ],
  "install_risk": "low",
  "runtime_risk": "medium",
  "trust_dependency": "opaque",
  "warnings": [
    "Uses external API with unclear data handling",
    "No transparency on where email content is sent"
  ],
  "recommendations": [
    "Verify API endpoint and data handling policy",
    "Limit data exposure before use"
  ],
  "verdict": "caution",
  "verified": false,
  "verification": {
    "status": "not_run",
    "receipt_id": null,
    "notes": ""
  }
}

---

Optional Verification Workflow#

Use verification only after the local review is complete.

Recommended pattern:

1. Define a deterministic verification spec for the report

   • required fields present
   • risk labels internally consistent
   • verdict supported by findings
   • no prohibited data included

2. Submit only the structured report and spec

3. Interpret results conservatively

   • PASS → attach receipt metadata and mark verified: true
   • FAIL → correct the report and keep verified: false
   • INDETERMINATE → keep verified: false and escalate for manual review

Verification is optional and must never override local safety concerns.

OpenClaw Setup (Recommended)#

OpenClaw is the best fit for this skill because it supports packaged skills, hooks, and workspace context.

Installation#

Via ClawHub:

bash

clawdhub install skill-vetter-v2

Manual:

This legacy package does not currently publish a source install URL. Use the ClawHub listing/package as the reference artifact.

Optional Hook#

Install the reminder hook if you want a prompt to vet skills before trusting them:

bash

cp -r hooks/openclaw ~/.openclaw/hooks/skill-vetter-v2
openclaw hooks enable skill-vetter-v2

Local Scan Helper#

Run the local helper against a skill folder:

bash

bash scripts/scan-skill.sh /path/to/skill

This helper inventories files and flags common red-patterns locally. It does not make network calls.

Generic Setup (Other Agents)#

Use this skill with Claude Code, Codex, Copilot, or other agents by copying the package into your skills directory and reviewing target skills locally.

Suggested workflow:

1. Read the target SKILL.md
2. Read all scripts, hooks, and references
3. Run the local scan helper
4. Write the structured report
5. Optionally verify the report

What This Is Not#

• not an installer
• not an auto-executor for unknown code
• not an external decision authority
• not a replacement for human judgment on high-risk skills

Outcome#

Agents can:

• understand what a skill actually does before use
• identify install-time and runtime risks clearly
• separate transparent dependencies from opaque trust requirements
• keep safety decisions local while optionally producing verifiable records

Claim precision note#

This version clarifies that the skill is a verifiability-guided workflow aid. It does not itself perform cryptographic verification, emit Settlement Attestation Receipts, verify receipts, verify signatures, prove that a skill is safe, or approve execution. For receipt verification, use SettlementWitness or DefaultVerifier MCP verify_receipt.

Keywords#

ai-agents, skill-safety, risk-analysis, verification, trust, security