Skill Vetter V2 0.0.6

It helps identify risky instructions, unclear authority boundaries, hidden assumptions, undeclared egress, provenance gaps, and claims that exceed evidence.

This skill does not itself perform cryptographic verification, emit Settlement Attestation Receipts, or prove that a skill is safe. It is a structured review workflow.

For actual receipt verification, use SettlementWitness or DefaultVerifier MCP verify_receipt.

Category: verifiability-guided workflow skill.

Boundary: Skill Vetter v2 reviews claims and risk signals; it does not certify, approve, execute, or cryptographically verify artifacts.

---

Analyze skills before installation or use. Classify capabilities, risks, and trust dependencies with structured local review. Optionally verify the completed report with SettlementWitness.

This is a **packaged vetting skill**, not a thin wrapper. It preserves local inspection as the primary decision path and adds an optional verification layer for auditability.

## Data handling and trust

This skill defines a **local review workflow** with an optional verification step for the final report.

* Perform capability analysis and risk classification locally
* Do **not** send secrets, credentials, private keys, seed phrases, personal data, or full private repositories to any external service
* If optional verification is used, send only the minimum structured task data needed to validate the report
* Verification does **not** decide whether a skill is safe to install; it only validates that the vetting report matches the stated evaluation spec
* Identity is optional; no wallet access, account access, or credentials are required

## Core Principle

Never outsource the safety decision.

External systems may help verify that a report was produced correctly, but the actual judgment about whether a skill should be trusted remains local and reviewable.

## Quick Reference

| Situation                                      | Action                                                         |
| ---------------------------------------------- | -------------------------------------------------------------- |
| New skill from unknown source                  | Run full local vetting workflow                                |
| Skill asks for secrets or credentials          | Escalate risk immediately                                      |
| Skill writes outside workspace                 | Mark as high risk unless clearly justified                     |
| Skill calls external services                  | Classify trust dependency and data exposure                    |
| Skill contains obfuscation or hidden execution | Mark unsafe                                                    |
| Final report is complete                       | Optionally verify the report structure and verdict consistency |
| Verification returns PASS                      | Attach receipt metadata to the report                          |
| Verification returns FAIL                      | Re-check findings and correct the report                       |
| Verification returns INDETERMINATE             | Hold for manual review; do not treat as verified               |

## What This Skill Does

Skill Vetter v2 evaluates a target skill across four dimensions:

1. **Purpose and scope**
   What the skill claims to do, and whether its requested capabilities match that purpose.

2. **Install-time behavior**
   File writes, package installs, hooks, system changes, or bootstrap modifications.

3. **Runtime behavior**
   Commands, file access, network access, external APIs, tool usage, and data handling.

4. **Trust dependency**
   Whether the skill depends on transparent and reviewable systems, or on opaque and unverifiable services.

## Core Execution Loop

1. Inspect the skill package locally

   * `SKILL.md`
   * `README.md` and references
   * scripts, hooks, assets, templates
   * metadata and install surface

2. Identify declared and implied capabilities

   * file reads and writes
   * command execution
   * package installation
   * network or API usage
   * handling of credentials, memory, or sensitive files

3. Evaluate risk

   * install-time risk
   * runtime risk
   * data exposure risk
   * trust dependency risk

4. Generate a structured report

5. Optional: verify the completed report

   * define a deterministic verification spec for the report structure and verdict logic
   * run verification only on the minimal structured report payload
   * attach receipt metadata only when verification passes

## Risk Evaluation Categories

### Install-Time Risk

Review for:

* file writes outside the workspace
* package installs or dependency changes
* shell profile or system configuration changes
* hook registration or startup injection
* hidden setup steps not stated in the docs

### Runtime Risk

Review for:

* external API calls
* arbitrary command execution
* broad file system access
* credential discovery or token handling
* browser/session access
* transmission of user data or memory files

### Trust Dependency

Classify the skill's external dependencies:

* **none** — local-only behavior, no external trust dependency
* **transparent** — external dependency is narrow, explicit, and independently understandable
* **opaque** — external dependency is broad, hidden, unverifiable, or requests sensitive data

## Red Flags

Reject or escalate immediately if you find:

* requests for credentials, API keys, seed phrases, or private keys
* access to secret stores or credential directories without a clear need
* obfuscated or encoded execution logic intended to hide behavior
* silent network transmission of prompts, memory, or workspace files
* writes outside expected directories without a clear reason
* privilege escalation or system-level modification
* unexplained background processes, persistence, or surveillance behavior

## Output Format

```json id="m8yx3p"
{
  "skill_name": "...",
  "purpose": "...",
  "source": "clawhub | github | local | other",
  "capabilities": ["..."],
  "install_risk": "low | medium | high | extreme",
  "runtime_risk": "low | medium | high | extreme",
  "trust_dependency": "none | transparent | opaque",
  "warnings": ["..."],
  "recommendations": ["..."],
  "verdict": "safe | caution | unsafe",
  "verified": false,
  "verification": {
    "status": "not_run | pass | fail | indeterminate",
    "receipt_id": null,
    "notes": ""
  }
}
```

---

## Example Usage

### Input (Skill to Review)

```json id="9j3kdx"
{
  "skill_name": "example-email-sender",
  "source": "github",
  "description": "Sends automated emails using an external API",
  "files": ["SKILL.md", "scripts/send-email.sh"]
}
```

### Output (Vetting Report)

```json id="4n6rfa"
{
  "skill_name": "example-email-sender",
  "purpose": "Send automated emails via external API",
  "source": "github",
  "capabilities": [
    "network access",
    "external API calls",
    "file read/write"
  ],
  "install_risk": "low",
  "runtime_risk": "medium",
  "trust_dependency": "opaque",
  "warnings": [
    "Uses external API with unclear data handling",
    "No transparency on where email content is sent"
  ],
  "recommendations": [
    "Verify API endpoint and data handling policy",
    "Limit data exposure before use"
  ],
  "verdict": "caution",
  "verified": false,
  "verification": {
    "status": "not_run",
    "receipt_id": null,
    "notes": ""
  }
}
```

---

## Optional Verification Workflow

Use verification only after the local review is complete.

Recommended pattern:

1. Define a deterministic verification spec for the report

   * required fields present
   * risk labels internally consistent
   * verdict supported by findings
   * no prohibited data included

2. Submit only the structured report and spec

3. Interpret results conservatively

   * **PASS** → attach receipt metadata and mark `verified: true`
   * **FAIL** → correct the report and keep `verified: false`
   * **INDETERMINATE** → keep `verified: false` and escalate for manual review

Verification is optional and must never override local safety concerns.

## OpenClaw Setup (Recommended)

OpenClaw is the best fit for this skill because it supports packaged skills, hooks, and workspace context.

### Installation

**Via ClawHub:**

```bash id="t2j9mf"
clawdhub install skill-vetter-v2
```

**Manual:**

This legacy package does not currently publish a source install URL. Use the ClawHub listing/package as the reference artifact.

### Optional Hook

Install the reminder hook if you want a prompt to vet skills before trusting them:

```bash id="0xptv9"
cp -r hooks/openclaw ~/.openclaw/hooks/skill-vetter-v2
openclaw hooks enable skill-vetter-v2
```

### Local Scan Helper

Run the local helper against a skill folder:

```bash id="z7p2qs"
bash scripts/scan-skill.sh /path/to/skill
```

This helper inventories files and flags common red-patterns locally. It does not make network calls.

## Generic Setup (Other Agents)

Use this skill with Claude Code, Codex, Copilot, or other agents by copying the package into your skills directory and reviewing target skills locally.

Suggested workflow:

1. Read the target `SKILL.md`
2. Read all scripts, hooks, and references
3. Run the local scan helper
4. Write the structured report
5. Optionally verify the report

## What This Is Not

* not an installer
* not an auto-executor for unknown code
* not an external decision authority
* not a replacement for human judgment on high-risk skills

## Outcome

Agents can:

* understand what a skill actually does before use
* identify install-time and runtime risks clearly
* separate transparent dependencies from opaque trust requirements
* keep safety decisions local while optionally producing verifiable records

## Claim precision note

This version clarifies that the skill is a verifiability-guided workflow aid. It does not itself perform cryptographic verification, emit Settlement Attestation Receipts, verify receipts, verify signatures, prove that a skill is safe, or approve execution. For receipt verification, use SettlementWitness or DefaultVerifier MCP verify_receipt.

## Keywords

ai-agents, skill-safety, risk-analysis, verification, trust, security