skill-vetting
Vet an agent skill before installing it — read the SKILL.md and any scripts for the red-flag patterns (credential access, obfuscation, exfiltration, prompt injection), audit its blast radius, and produce a risk-tiered verdict. Use when asked is this skill safe to install, vet this SKILL.md, review this skill from a marketplace, or check what this skill can do to my machine. Produces the risk classification with quoted evidence, the permission-surface audit, the red-flag checklist results, and an install/sandbox/reject recommendation.
npx skills add mohitagw15856/pm-claude-skills --skill skill-vetting --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Skill Vetting Skill A skill is instructions your agent will *obey* plus scripts your machine will *run* — installing one is granting authorship over future behavior, and marketplaces host both gems and traps. This skill is the pre-install reading: the red-flag pattern sweep, the blast-radius audit ("what can this touch"), and a tiered verdict with quoted evidence. It's a judgment framework, not a scanner — the point is an informed human decision, and for anything above LOW the human makes it. ## What This Skill Produces - **The verdict** — 🟢 LOW / 🟡 MEDIUM / 🔴 HIGH / ⛔ REJECT, with the one-paragraph reasoning - **The evidence table** — every finding with the quoted line from the skill's own files - **The blast-radius audit** — files read/written, network destinations, commands run, credentials touched - **The recommendation** — install / install-but-watch / sandbox first / reject, matched to the tier ## Required Inputs Ask for these if not provided: - **The skill's contents** — SKILL.md plus *everything else in the folder* (scripts, references, hooks); a skill vetted by its README alone is not vetted - **The provenance** — source (official repo, known author, unknown upload),
- What This Skill Produces
- Required Inputs
- Framework: The Sweep, the Radius, the Tiering
- Output Format
- Evidence
- Blast Radius
- Provenance
- Recommendation
- Quality Checks
- Anti-Patterns
What does the skill-vetting skill do?
Vet an agent skill before installing it — read the SKILL.md and any scripts for the red-flag patterns (credential access, obfuscation, exfiltration, prompt injection), audit its blast radius, and produce a risk-tiered verdict. Use when asked is this skill safe to install, vet this SKILL.md, review this skill from a marketplace, or check what this skill can do to my machine. Produces the risk classification with quoted evidence, the permission-surface audit, the red-flag checklist results, and an install/sandbox/reject recommendation.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill skill-vetting --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.