AugmentClaude

Skill Vetter

Review and classify security risks in skill packages before installation.

Installation

  1. Make sure Claude is on your device and in your terminal.

    Skills load from ~/.claude/skills/ when Claude Code starts up — so you need it on your machine first. If you don't have it yet, install it once with the command below, then run claude in any terminal to verify.

    One-time setup
    npm i -g @anthropic-ai/claude-code

    Already have it? Skip ahead.

  2. Paste into Claude Code or into your terminal.

    This copies the whole skill folder into ~/.claude/skills/skill-vetter-runtime-uvwt/ — the SKILL.md plus any scripts, reference docs, or templates the skill ships with. Safe default: works for every skill.

    Faster alternative (instruction-only skills)

    Skips the clone and grabs only the SKILL.md file. Don't use this if the skill ships Python scripts, reference markdowns, or asset templates — they won't be downloaded and the skill will fail when it tries to load them.

    Quick install (SKILL.md only)
    Sign up to copy
  3. Restart Claude Code.

    Quit and reopen Claude Code (or any other agent that loads from ~/.claude/skills/). New skills are picked up on startup.

  4. Just ask Claude.

    Skills auto-activate when your request matches the skill's description — no slash command needed. Trigger phrases live in the skill's own frontmatter; you can read them in the “What this skill does” section above.

Prefer to read the source first? Open on GitHub.

When Claude uses it

Review ClawHub or local Skill packages before installation, classify risk, and return a structured security report.

What this skill does

Skill Vetter

This Skill provides a security-first review workflow and an optional helper script for inspecting ClawHub slugs or local Skill directories.

Use it before installing unknown skills, when comparing candidate skills, or when checking whether a local Skill has suspicious code, broad permissions, credential access, persistence hooks, or risky network behavior.

The output is a structured JSON report with reviewed files, detected red flags, permission clues, risk level, verdict, and notes.

辅助脚本执行

Skill 本体是本说明文档。确需调用包内辅助脚本时,在 Skill 包根目录使用相对路径执行;运行宿主负责切换到包根目录并把所需变量注入当前子进程。

printf '%s' '{"skill_action":"<动作>"}' | python3 run.py

输入必须是 JSON 对象。写操作仍按本文档中的确认规则执行。

动作用途
statusCheck Python runtime and optional ClawHub CLI availability.
vet-clawhub-slugFetch and vet a ClawHub skill by slug without installing it.
vet-local-pathVet a local skill folder. By default only AgentDock workspace and installed skill roots are allowed.

Related skills