---

name: skillvet description: "Security scanner for ClawHub/community skills — detects malware, credential theft, exfiltration, prompt injection, obfuscation, homograph attacks, ANSI injection, campaign-specific attack patterns, and more before you install. Use when installing skills from ClawHub or any public marketplace, reviewing third-party agent skills for safety, or vetting untrusted code before giving it to your AI agent. Triggers: install skill, audit skill, check skill, vet skill, skill security, safe install, is this skill safe." compatibility: "Requires bash, grep, find, and file (standard POSIX). safe-install.sh and scan-remote.sh require the clawdhub CLI. perl or ggrep (Homebrew GNU grep) recommended for full Unicode regex support on macOS." metadata: version: "2.0.9" author: oakencore

Skillvet

Security scanner for agent skills. 48 critical checks, 8 warning checks. No dependencies — just bash and grep. Includes Tirith-inspired detection patterns, campaign signatures from Koi Security, Bitdefender, Snyk, and 1Password ClickFix patterns.

Usage

Safe install (installs, audits, auto-removes if critical):

bash skills/skillvet/scripts/safe-install.sh <skill-slug>

Audit an existing skill:

bash skills/skillvet/scripts/skill-audit.sh skills/some-skill

Audit all installed skills:

for d in skills/*/; do bash skills/skillvet/scripts/skill-audit.sh "$d"; done

JSON output (for automation):

bash skills/skillvet/scripts/skill-audit.sh --json skills/some-skill

SARIF output (for GitHub Code Scanning / VS Code):

bash skills/skillvet/scripts/skill-audit.sh --sarif skills/some-skill

Summary mode (one-line per skill):

bash skills/skillvet/scripts/skill-audit.sh --summary skills/some-skill

Verbose mode (debug which checks run and what files are scanned):

bash skills/skillvet/scripts/skill-audit.sh --verbose skills/some-skill

Scan remote skill without installing:

bash skills/skillvet/scripts/scan-remote.sh <skill-slug>

Diff scan (only scan what changed between versions):

bash skills/skillvet/scripts/diff-scan.sh path/to/old-version path/to/new-version

Exit codes: 0 clean, 1 warnings only, 2 critical findings.

Advanced Options

Suppressing False Positives

Create a .skillvetrc file in the skill directory to disable specific checks:

# Disable check #4 (obfuscation) and #20 (shortened URLs)
disable:4
disable:20

Or add inline comments to suppress individual lines:

const url = "https://bit.ly/legit-link"; // skillvet-ignore

Pre-commit Hook

Install the git pre-commit hook to auto-scan skills before committing:

ln -sf ../../scripts/pre-commit-hook .git/hooks/pre-commit

Risk Scoring

Each finding has a severity weight (1-10). The aggregate risk score is included in JSON, SARIF, and summary output. Higher scores indicate more dangerous patterns:

• 10: Reverse shells, known C2 IPs
• 9: Data exfiltration, pipe-to-shell, persistence + network, ClickFix, base64 execution
• 7-8: Credential theft, obfuscation, path traversal, time bombs
• 4-6: Punycode, homographs, ANSI injection, shortened URLs
• 2-3: Subprocess execution, network requests, file writes

Critical Checks (auto-blocked)

Core Security Checks (1-24)

Warning Checks (flagged for review)

Scanned File Types

.md, .js, .ts, .tsx, .jsx, .py, .sh, .bash, .rs, .go, .rb, .c, .cpp, .json, .yaml, .yml, .toml, .txt, .env*, Dockerfile*, Makefile, pom.xml, .gradle.

Binary files are automatically skipped. Symlinks are followed.

Portability

Works on Linux and macOS. Unicode checks (#12, #16, #17) use grep -P where available, falling back to perl on systems without Perl-compatible regex (e.g., stock macOS). If neither is available, those checks are silently skipped.

IOC Updates

The C2 IP blocklist in check #25 is based on known indicators from:

• Koi Security report (Feb 2026)
• The Hacker News coverage
• OpenSourceMalware analysis

To update IOCs, edit the KNOWN_IPS entry in scripts/patterns.b64 (base64-encoded regex pattern).

CI/CD Integration

GitHub Actions

A .github/workflows/test.yml is included — runs the test suite on both Ubuntu and macOS on push/PR.

GitHub Code Scanning (SARIF)

- name: Run skillvet
  run: bash scripts/skill-audit.sh --sarif skills/some-skill > results.sarif || true

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Limitations

Static analysis only. English-centric prompt injection patterns. Minified JS is flagged but not deobfuscated. A clean scan raises the bar but doesn't guarantee safety.

The scanner flags itself when audited — its own patterns contain the strings it detects. Use --exclude-self to skip self-scanning in CI.