clawhub-skill-vetting

Security-first vetting workflow for evaluating ClawHub skills before installation. Apply a strict, security‑first vetting workflow before installing any ClawHub skill. Prioritize code review, permission scope, domain listing, and risk scoring. Use references/vetting-guide.md for the full checklist, commands, red flags, confidence scoring, and report template. - Mandatory code review scanning for exfiltration, secrets access, eval/exec, and obfuscation across all files - Six-step vetting process covering source reputation, permission scope, recent activity, community feedback, and safe installation practices - Produces structured SKILL VETTING REPORT with go/no-go recommendation, confidence scoring, and explicit red flag callouts - Includes reference checklist with commands, risk indicators, and sandbox installation guidance for uncertain cases - Source check — author reputation, stars/downloads, last update, reviews. - Code review (MANDATORY) — scan all files for exfiltration, secrets access, eval/exec , obfuscation. - Permission scope — files, commands, network; confirm minimal scope. - Recent activity — detect suspicious bursts.