skill-vetter-runtime
Review ClawHub or local Skill packages before installation, classify risk, and return a structured security report.
Profile →npx skills add uvwt/agentdock --skill skill-vetter-runtime --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Skill Vetter This Skill provides a security-first review workflow and an optional helper script for inspecting ClawHub slugs or local Skill directories. Use it before installing unknown skills, when comparing candidate skills, or when checking whether a local Skill has suspicious code, broad permissions, credential access, persistence hooks, or risky network behavior. The output is a structured JSON report with reviewed files, detected red flags, permission clues, risk level, verdict, and notes. ## 辅助脚本执行 Skill 本体是本说明文档。确需调用包内辅助脚本时，在 Skill 包根目录使用相对路径执行；运行宿主负责切换到包根目录并把所需变量注入当前子进程。 ```bash printf '%s' '{"skill_action":"<动作>"}' | python3 run.py ``` 输入必须是 JSON 对象。写操作仍按本文档中的确认规则执行。 | 动作 | 用途 | |---|---| | `status` | Check Python runtime and optional ClawHub CLI availability. | | `vet-clawhub-slug` | Fetch and vet a ClawHub skill by slug without installing it. | | `vet-local-path` | Vet a local skill folder. By default only AgentDock workspace and installed skill roots are allowed. |
- 辅助脚本执行
printf '%s' '{"skill_action":"<动作>"}' | python3 run.pyWhat does the skill-vetter-runtime skill do?
Review ClawHub or local Skill packages before installation, classify risk, and return a structured security report.
How do I install it?
Run `npx skills add uvwt/agentdock --skill skill-vetter-runtime --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From uvwt/agentdock, a repository with 183 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.