AI 에이전트 기술을 위한 멀티 스캐너 보안 게이트. Claude Code, OpenClaw, 또는 ClawHub, GitHub, 또는 외부 소스와 같은 다른 좋아하는 AI 에이전트를 설치하기 전에 실행하십시오.

설치

** One-liner** (사전 예약 + 기술 설치):

Claude 코드:

OpenClaw (ClawHub를 통해):

클래드 코드 세션 내에서:

Ask Claude : “Install Skill-vetter from https://github.com/app-incubator-xyz/skill-vetter”]

기본적인 스캐너 (secrets + 구조 체크)를 가진 상자에서 작동하십시오. aguara 및 skill-scanner] 전체 적용 - 실행 bash scripts/check-deps.sh] 누락된 것을 볼 수 있습니다.

실행하는 방법

맨끝에서

에이전트 세션에서

Type /skill-vetter 또는 설치하기 전에 기술을 검사하는 에이전트를 요청합니다.

텔레그램 슬래시 명령으로

Skill Vetter는 OpenClaw의 Telegram 채널을 통해 Telegram slash 명령으로 작동합니다.

1. @BotFather를 통해 봇을 만들고 토큰을 복사
2. 봇 토큰(Setup guide)과 OpenClaw 구성
3. OpenClaw Gateway 시작 - user-invocable: true] 텔레그램 명령으로 자동 등록
4. /skill_vetter ] Telegram에서 기술을 스캔합니다

Skill Vetter

Multi-scanner security gate for AI agent skills. Run before installing any skill to Claude Code, OpenClaw, or your other favorite AI agent — whether from ClawHub, GitHub, or any external source.

Installation

One-liner (installs prerequisites + skill):

bash <(curl -s https://raw.githubusercontent.com/app-incubator-xyz/skill-vetter/master/scripts/install.sh)

Claude Code:

git clone https://github.com/app-incubator-xyz/skill-vetter.git ~/.claude/skills/skill-vetter

OpenClaw (via ClawHub):

clawhub install skill-vetter

From within a Claude Code session:

Ask Claude: “Install skill-vetter from https://github.com/app-incubator-xyz/skill-vetter”

Works out of the box with basic scanners (secrets + structure checks). Install aguara and skill-scanner for full coverage — run bash scripts/check-deps.sh to see what’s missing.

How to Run

From terminal

bash scripts/vett.sh 

From an agent session

Type /skill-vetter or ask the agent to scan a skill before installing it.

As a Telegram slash command

Skill Vetter works as a Telegram slash command via OpenClaw’s Telegram channel:

1. Create a bot via @BotFather and copy the token
2. Configure OpenClaw with your bot token (setup guide)
3. Start the OpenClaw gateway — skills with user-invocable: true auto-register as Telegram commands
4. Use /skill_vetter in Telegram to scan a skill

Note: Telegram command names only allow [a-z0-9_] — the hyphen in skill-vetter becomes an underscore automatically.

Example Output

SAFE

════════════════════════════════════════════════════════════
SKILL VETTER — Security Scan: youtube-watcher
════════════════════════════════════════════════════════════

[1/4] aguara............. ✅ PASS
[2/4] skill-scanner...... ✅ PASS
[3/4] secrets-scan....... ✅ PASS
[4/4] structure-check.... ✅ PASS

════════════════════════════════════════════════════════════
VERDICT: ✅ SAFE
All scanners passed
════════════════════════════════════════════════════════════

BLOCKED

════════════════════════════════════════════════════════════
SKILL VETTER — Security Scan: totally-legit-helper
════════════════════════════════════════════════════════════

[1/4] aguara............. ❌ FAIL (prompt injection)
[2/4] skill-scanner...... ✅ PASS
[3/4] secrets-scan....... ❌ FAIL (credentials found)
[4/4] structure-check.... ❌ FAIL (curl|bash detected)

════════════════════════════════════════════════════════════
VERDICT: 🚫 BLOCKED
3 HIGH/CRITICAL findings
════════════════════════════════════════════════════════════

Scanners