# clawhub-skill-vetting

Audits ClawHub skills before installation by checking code, permissions, activity, and red flags. Use it when a skill’s trust level is uncertain.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1600 installs · ★ 5
- Author: hugomrtz
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/hugomrtz/skill-vetting-clawhub/tree/HEAD/SKILL.md
- Updated: 2026-02-19
- HTML: https://affpapa.org/en/nevibecode/skills/clawhub-skill-vetting

## What it does

This skill applies a pre-install review to ClawHub skills. It checks the author, stars and downloads, update history, and reviews, then examines every file for data exfiltration, secret access, `eval/exec`, and obfuscation.

It also reviews file, command, and network permissions, looks for suspicious bursts of activity, and includes Discord or GitHub Discussions in the assessment. A sandbox install with permission inspection is part of the safe-install path. The result uses the SKILL VETTING REPORT format with a go/no-go decision, explicit red flags, a confidence score, and a threshold. Code review is mandatory here, so skipping it breaks the defined workflow.

The detailed checklist, commands, risk signals, and report template are in `references/vetting-guide.md`. The reviewer needs access to the skill’s source files and permission scope.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/clawhub-skill-vetting/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/clawhub-skill-vetting/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/clawhub-skill-vetting/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/clawhub-skill-vetting/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install hugomrtz/skill-vetting-clawhub clawhub-skill-vetting
```

2. **Manually: put the files in place**
- File: `.github/skills/clawhub-skill-vetting/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/hugomrtz/skill-vetting-clawhub
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/clawhub-skill-vetting/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add hugomrtz/skill-vetting-clawhub --skill clawhub-skill-vetting -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/hugomrtz/skill-vetting-clawhub/tree/HEAD/SKILL.md

## When to use it
- audit a ClawHub skill before installation
- spot secret access and network exfiltration
- check file and command permissions
- flag suspicious author activity
- produce a go/no-go report

## Example prompts
- Audit this ClawHub skill before I install it and write the required report.
- Inspect every file for `eval/exec`, obfuscation, secret access, or data exfiltration.
- Review the skill’s permissions and decide whether it should run in a sandbox.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md