Skillvet

Anyone can publish a skill to ClawHub. That's what makes it powerful — and risky. A single malicious skill can steal your API keys, exfiltrate your environment variables, inject prompts into your agent, or open a reverse shell on your machine.

Skillvet scans skills before you use them. It runs 24 critical checks and 8 warning checks against every file in a skill directory, looking for credential theft, data exfiltration, prompt injection, obfuscation, and more. No dependencies — just bash and grep.

Usage

Safe install — installs a skill, audits it, and auto-removes it if critical issues are found:

bash skills/skillvet/scripts/safe-install.sh <skill-slug>

Scan before installing — downloads a skill to a temp directory, scans it, deletes it:

bash skills/skillvet/scripts/scan-remote.sh <skill-slug>

Audit a skill you already have:

bash skills/skillvet/scripts/skill-audit.sh skills/some-skill

Audit every installed skill:

for d in skills/*/; do bash skills/skillvet/scripts/skill-audit.sh "$d"; done

Diff scan — after an update, scan only what changed between versions:

bash skills/skillvet/scripts/diff-scan.sh skills/old-version skills/new-version

Exit codes: 0 clean, 1 warnings only, 2 critical findings (blocked).

Output formats

All scripts accept --json for structured output and --summary for a single-line result.

# JSON — for CI pipelines and dashboards
bash skills/skillvet/scripts/skill-audit.sh --json skills/some-skill

# Summary — for batch scanning and notifications
for d in skills/*/; do bash skills/skillvet/scripts/skill-audit.sh --summary "$d"; done

What it catches

Critical — skill is blocked

Warnings — flagged for manual review

Limitations

This is static analysis — pattern matching with grep. It raises the bar significantly but doesn't guarantee safety. Minified JS is flagged but not deobfuscated. Prompt injection detection is English-centric.

The scanner flags itself when audited. Its own source code contains the patterns it detects. This is expected.