clawhub-skill-vetting

The clawhub-skill-vetting skill applies a strict, security-first workflow for evaluating ClawHub and OpenClaw skills before installation. It addresses the risk of installing untrusted skills by prioritizing code review, permission scope, and risk scoring.

Its workflow runs a source check (author reputation, stars/downloads, recency, reviews), a mandatory code review scanning all files for exfiltration, secrets access, eval/exec usage, and obfuscation, a permission-scope review of file, command, and network access, a recent-activity check for suspicious bursts, a community check, and a safe install step that uses a sandbox with permission inspection. A bundled references/vetting-guide.md provides the full checklist, commands, red flags, and confidence scoring.

It is most useful when a user needs to audit or safely install a ClawHub skill, or when a skill's trustworthiness is in question, producing a structured SKILL VETTING REPORT with a clear go/no-go recommendation.