name: skill-vetter-optimized version: 2.0.0 description: "🔒 最佳化版技能審查器 - 安全優先的AI代理技能審查工具。在從ClawHub、GitHub或其他來源安裝任何技能前使用。檢查紅標、許可權範圍和可疑模式。包含實用工具和系統化審查清單。基於原始skill-vetter最佳化，添加了Python檢查指令碼和詳細審查流程。"

Skill Vetter Optimized 🔒✨

最佳化版技能審查器 - 基於原始skill-vetter最佳化增強

🚀 最佳化亮點

7w4.net小蔥技能站，你的AI助手技能庫。

✅ 新增實用工具 - Python檢查指令碼快速分析技能目錄
✅ 系統化審查流程 - 四階段審查清單
✅ 詳細文件 - 完整的審查指南和示例
✅ 保持相容 - 完全相容原始審查協議
✅ 效能最佳化 - 更快的審查流程

Security-first vetting protocol for AI agent skills. Never install a skill without vetting it first.

When to Use

• Before installing any skill from ClawdHub
• Before running skills from GitHub repos
• When evaluating skills shared by other agents
• Anytime you're asked to install unknown code

Vetting Protocol

Step 1: Source Check

Questions to answer:
- [ ] Where did this skill come from?
- [ ] Is the author known/reputable?
- [ ] How many downloads/stars does it have?
- [ ] When was it last updated?
- [ ] Are there reviews from other agents?

Step 2: Code Review (MANDATORY)

Read ALL files in the skill. Check for these RED FLAGS:

🚨 REJECT IMMEDIATELY IF YOU SEE:
─────────────────────────────────────────
• curl/wget to unknown URLs
• Sends data to external servers
• Requests credentials/tokens/API keys
• Reads ~/.ssh, ~/.aws, ~/.config without clear reason
• Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
• Uses base64 decode on anything
• Uses eval() or exec() with external input
• Modifies system files outside workspace
• Installs packages without listing them
• Network calls to IPs instead of domains
• Obfuscated code (compressed, encoded, minified)
• Requests elevated/sudo permissions
• Accesses browser cookies/sessions
• Touches credential files
─────────────────────────────────────────

Step 3: Permission Scope

Evaluate:
- [ ] What files does it need to read?
- [ ] What files does it need to write?
- [ ] What commands does it run?
- [ ] Does it need network access? To where?
- [ ] Is the scope minimal for its stated purpose?

Step 4: Risk Classification

Output Format

After vetting, produce this report:

SKILL VETTING REPORT
═══════════════════════════════════════
Skill: [name]
Source: [ClawdHub / GitHub / other]
Author: [username]
Version: [version]
───────────────────────────────────────
METRICS:
• Downloads/Stars: [count]
• Last Updated: [date]
• Files Reviewed: [count]
───────────────────────────────────────
RED FLAGS: [None / List them]

PERMISSIONS NEEDED:
• Files: [list or "None"]
• Network: [list or "None"]  
• Commands: [list or "None"]
───────────────────────────────────────
RISK LEVEL: [🟢 LOW / 🟡 MEDIUM / 🔴 HIGH / ⛔ EXTREME]

VERDICT: [✅ SAFE TO INSTALL / ⚠️ INSTALL WITH CAUTION / ❌ DO NOT INSTALL]

NOTES: [Any observations]
═══════════════════════════════════════

實用工具

1. 技能檢查指令碼

使用內建的Python指令碼快速檢查技能目錄：

# 檢查技能目錄的基本資訊和安全風險
python3 /root/.openclaw/skills/skill-vetter/scripts/skill_checker.py /path/to/skill

2. GitHub倉庫檢查

對於GitHub託管的技能：

# 檢查倉庫統計資訊
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'

# 列出技能檔案
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

# 獲取並審查SKILL.md
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

3. 使用審查清單

參考 references/checklist.md 進行系統化的技能審查。

Trust Hierarchy

1. Official OpenClaw skills → Lower scrutiny (still review)
2. High-star repos (1000+) → Moderate scrutiny
3. Known authors → Moderate scrutiny
4. New/unknown sources → Maximum scrutiny
5. Skills requesting credentials → Human approval always

Remember

• No skill is worth compromising security
• When in doubt, don't install
• Ask your human for high-risk decisions
• Document what you vet for future reference

Paranoia is a feature. 🔒🦀

這是一個用於安全審查 AI 技能的輔助工具，能幫助你在安裝前檢查潛在風險。文件寫得很清晰，提供了實用的審查流程和檢查清單，對安全意識較強的使用者很有幫助。不足之處是功能相對基礎，很多檢查需要手動完成，自動化程度有限，且目前版本未經過充分測試。對於普通使用者來說，這個工具更適合作為輔助參考，不能完全替代仔細閱讀程式碼的步驟。