Skill Vetter Plus

What It Does

Scans AI agent skills for security issues:

• 9 built-in detection signatures (secrets, execution, prompt injection)
• Sub-50ms scan time
• Run before installing any unknown skill

How to Use

# Scan any skill directory
python3 scripts/vetter.py /path/to/installed/skill

# JSON output for piping
python3 scripts/vetter.py /path/to/skill --json

Signatures

What It Does NOT Do

• No AST analysis (text matching only)
• Cannot detect control-flow obfuscation
• Cannot analyze compiled binaries
• Not a replacement for manual code review

Results

Scanned 12 files in 23ms
Found 1 issue(s):
  [CRITICAL] unsafe-eval at /skill/scripts/mail.py:45
    → eval() can execute arbitrary code (matched: 'eval(')

Pro Upgrade

Limitations

• Text-based pattern matching
• Cannot detect all malware — only patterns in the signature database

Attribution

• Built by: CertainLogic
• Concept: Skill security pre-checking (industry standard practice)

Links

• GitHub: https://github.com/CertainLogicAI/skill-vetter-plus
• ClawHub: https://clawhub.ai/certainlogicai/skill-vetter-plus
• Docs: https://certainlogic.ai/docs/skill-vetter-plus

Built by CertainLogic