name: skill-vetter-v2
description: Analyze any skill for safety before use. Preserve local judgment, classify risk clearly, and optionally verify the final report with SettlementWitness.
metadata:
---------
# Skill Vetter v2
Analyze skills before installation or use. Classify capabilities, risks, and trust dependencies with structured local review. Optionally verify the completed report with SettlementWitness.
This is a **packaged vetting skill**, not a thin wrapper. It preserves local inspection as the primary decision path and adds an optional verification layer for auditability.
## Data handling and trust
This skill defines a **local review workflow** with an optional verification step for the final report.
* Perform capability analysis and risk classification locally
* Do **not** send secrets, credentials, private keys, seed phrases, personal data, or full private repositories to any external service
* If optional verification is used, send only the minimum structured task data needed to validate the report
* Verification does **not** decide whether a skill is safe to install; it only validates that the vetting report matches the stated evaluation spec
* Identity is optional; no wallet access, account access, or credentials are required
## Core Principle
Never outsource the safety decision.
External systems may help verify that a report was produced correctly, but the actual judgment about whether a skill should be trusted remains local and reviewable.
## Quick Reference
| Situation | Action |
| ---------------------------------------------- | -------------------------------------------------------------- |
| New skill from unknown source | Run full local vetting workflow |
| Skill asks for secrets or credentials | Escalate risk immediately |
| Skill writes outside workspace | Mark as high risk unless clearly justified |
| Skill calls external services | Classify trust dependency and data exposure |
| Skill contains obfuscation or hidden execution | Mark unsafe |
| Final report is complete | Optionally verify the report structure and verdict consistency |
| Verification returns PASS | Attach receipt metadata to the report |
| Verification returns FAIL | Re-check findings and correct the report |
| Verification returns INDETERMINATE | Hold for manual review; do not treat as verified |
## What This Skill Does
Skill Vetter v2 evaluates a target skill across four dimensions:
1. **Purpose and scope**
What the skill claims to do, and whether its requested capabilities match that purpose.
2. **Install-time behavior**
File writes, package installs, hooks, system changes, or bootstrap modifications.
3. **Runtime behavior**
Commands, file access, network access, external APIs, tool usage, and data handling.
4. **Trust dependency**
Whether the skill depends on transparent and reviewable systems, or on opaque and unverifiable services.
## Core Execution Loop
1. Inspect the skill package locally
* `SKILL.md`
* `README.md` and references
* scripts, hooks, assets, templates
* metadata and install surface
2. Identify declared and implied capabilities
* file reads and writes
* command execution
* package installation
* network or API usage
* handling of credentials, memory, or sensitive files
3. Evaluate risk
* install-time risk
* runtime risk
* data exposure risk
* trust dependency risk
4. Generate a structured report
5. Optional: verify the completed report
* define a deterministic verification spec for the report structure and verdict logic
* run verification only on the minimal structured report payload
* attach receipt metadata only when verification passes
## Risk Evaluation Categories
### Install-Time Risk
Review for:
* file writes outside the workspace
* package installs or dependency changes
* shell profile or system configuration changes
* hook registration or startup injection
* hidden setup steps not stated in the docs
### Runtime Risk
Review for:
* external API calls
* arbitrary command execution
* broad file system access
* credential discovery or token handling
* browser/session access
* transmission of user data or memory files
### Trust Dependency
Classify the skill's external dependencies:
* **none** — local-only behavior, no external trust dependency
* **transparent** — external dependency is narrow, explicit, and independently understandable
* **opaque** — external dependency is broad, hidden, unverifiable, or requests sensitive data
## Red Flags
Reject or escalate immediately if you find:
* requests for credentials, API keys, seed phrases, or private keys
* access to secret stores or credential directories without a clear need
* obfuscated or encoded execution logic intended to hide behavior
* silent network transmission of prompts, memory, or workspace files
* writes outside expected directories without a clear reason
* privilege escalation or system-level modification
* unexplained background processes, persistence, or surveillance behavior
## Output Format
```json id="m8yx3p"
{
"skill_name": "...",
"purpose": "...",
"source": "clawhub | github | local | other",
"capabilities": ["..."],
"install_risk": "low | medium | high | extreme",
"runtime_risk": "low | medium | high | extreme",
"trust_dependency": "none | transparent | opaque",
"warnings": ["..."],
"recommendations": ["..."],
"verdict": "safe | caution | unsafe",
"verified": false,
"verification": {
"status": "not_run | pass | fail | indeterminate",
"receipt_id": null,
"notes": ""
}
}
```
Use verification only after the local review is complete.
Verification is optional and must never override local safety concerns.
OpenClaw is the best fit for this skill because it supports packaged skills, hooks, and workspace context.
Install the reminder hook if you want a prompt to vet skills before trusting them:
This helper inventories files and flags common red-patterns locally. It does not make network calls.
Use this skill with Claude Code, Codex, Copilot, or other agents by copying the package into your skills directory and reviewing target skills locally.