clawhub-skill-vetting — Claude Code skill: vetting
Audits ClawHub skills before installation by checking code, permissions, activity, and red flags. Use it when a skill’s trust level is uncertain.
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a claude-codeWhat clawhub-skill-vetting does
This skill applies a pre-install review to ClawHub skills. It checks the author, stars and downloads, update history, and reviews, then examines every file for data exfiltration, secret access, eval/exec, and obfuscation.
It also reviews file, command, and network permissions, looks for suspicious bursts of activity, and includes Discord or GitHub Discussions in the assessment. A sandbox install with permission inspection is part of the safe-install path. The result uses the SKILL VETTING REPORT format with a go/no-go decision, explicit red flags, a confidence score, and a threshold. Code review is mandatory here, so skipping it breaks the defined workflow.
The detailed checklist, commands, risk signals, and report template are in references/vetting-guide.md. The reviewer needs access to the skill’s source files and permission scope.
What it helps with
- audit a ClawHub skill before installation
- spot secret access and network exfiltration
- check file and command permissions
- flag suspicious author activity
- produce a go/no-go report
Example prompts for the agent
- Audit this ClawHub skill before I install it and write the required report.
- Inspect every file for
eval/exec, obfuscation, secret access, or data exfiltration. - Review the skill’s permissions and decide whether it should run in a sandbox.
How to install clawhub-skill-vetting
1Skills CLI (Vercel)
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a claude-code2Manually: put the files in place
~/.claude/skills/clawhub-skill-vetting/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/clawhub-skill-vetting/
1Skills CLI (Vercel)
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a codex2Manually: put the files in place
.agents/skills/clawhub-skill-vetting/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a cursor2Manually: put the files in place
.cursor/skills/clawhub-skill-vetting/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install hugomrtz/skill-vetting-clawhub clawhub-skill-vetting2Manually: put the files in place
.github/skills/clawhub-skill-vetting/SKILL.md1Skills CLI (Vercel)
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a gemini-cli2Platform CLI
gemini skills install https://github.com/hugomrtz/skill-vetting-clawhubManually: put the files in place
.devin/skills/clawhub-skill-vetting/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about clawhub-skill-vetting
How do I install clawhub-skill-vetting in Claude Code?
Run npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a claude-code, then inspect ~/.claude/skills/clawhub-skill-vetting/SKILL.md.
What does clawhub-skill-vetting do?
It reviews ClawHub skills before installation, covering source code, permissions, recent activity, and risk indicators. It returns a structured report with a go/no-go recommendation.
What does the code review look for?
The review covers every file and checks for exfiltration, secret access, eval/exec, and obfuscation. An unclear result leads to a sandbox-only recommendation or rejection.
