What can you do with this server?

This server performs security vetting of third-party AI agent extensions (Claude skills, ClawHub plugins, MCP servers, agent tool packs) before installation, using static analysis across 41 detection rules to detect malicious patterns and produce actionable risk scores. Risk Scoring & Bucketing: Assigns a 0–100 risk score and categorizes results into BLOCK (critical finding or score ≥ 80), REVIEW (high or score ≥ 50), CAUTION (medium or score ≥ 20), or CLEAN. Each finding includes rule ID, file/line, evidence, severity, and a recommendation. What it detects: Supply-chain attacks, prompt injection, hardcoded exfiltration channels (Discord/Slack webhooks, SSH key reads, env dumps), dangerous dynamic execution, manifest/permission drift, and typosquat dependencies. Tools: * vet_skill — Full scan of a single skill (manifest, code, AST, dependencies) returning a complete VetReport. * vet_skill_directory — Aggregate scan of all skills in the configured directory; useful for periodic audits. * installed_skills_overview — Lightweight dashboard: risk-level counts and IDs of flagged skills only. * flagged_skills_report — Only REVIEW/BLOCK skills with findings, sorted by risk score — for focused triage. * scan_for_prompt_injection — Targeted prompt-injection-only scan on a single skill. * scan_for_exfiltration — Targeted exfiltration-only scan on a single skill. * list_detection_rules — Full catalog of all 41 detection rules with IDs, severities, and descriptions. * vet_agent_config (v1.1+) — Scans project directories for adversarial agent-config files (e.g., AGENTS.md, .cursor/rules.md, .claude/CLAUDE.md, .gemini/config). Resources: skill-vetter://overview (risk overview), skill-vetter://flagged (flagged skills), skill-vetter://rules (rules catalog). Prompts: pre-install-skill-check (guided pre-install vetting), weekly-skill-audit (audit summary), agent-config-audit (scans for adversarial config files). Backends: mock (demo with 6 skills), openclaw-skills-dir (local ~/.openclaw/skills/), and planned clawhub-fetch (v1.1) for vetting registry skills before download. Scanners and backends are pluggable for custom adaptation.

How do I use openclaw-skill-vetter-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@openclaw-skill-vetter-mcp Vet the data-extractor skill before I install it." That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

openclaw-skill-vetter-mcp

by temurkhan13

Overview Schema Source Related Servers Discussions Admin

Python

Local

This server performs security vetting of third-party AI agent extensions (Claude skills, ClawHub plugins, MCP servers, agent tool packs) before installation, using static analysis across 41 detection rules to detect malicious patterns and produce actionable risk scores.

Risk Scoring & Bucketing: Assigns a 0–100 risk score and categorizes results into BLOCK (critical finding or score ≥ 80), REVIEW (high or score ≥ 50), CAUTION (medium or score ≥ 20), or CLEAN. Each finding includes rule ID, file/line, evidence, severity, and a recommendation.

What it detects: Supply-chain attacks, prompt injection, hardcoded exfiltration channels (Discord/Slack webhooks, SSH key reads, env dumps), dangerous dynamic execution, manifest/permission drift, and typosquat dependencies.

Tools:

vet_skill — Full scan of a single skill (manifest, code, AST, dependencies) returning a complete VetReport.
vet_skill_directory — Aggregate scan of all skills in the configured directory; useful for periodic audits.
installed_skills_overview — Lightweight dashboard: risk-level counts and IDs of flagged skills only.
flagged_skills_report — Only REVIEW/BLOCK skills with findings, sorted by risk score — for focused triage.
scan_for_prompt_injection — Targeted prompt-injection-only scan on a single skill.
scan_for_exfiltration — Targeted exfiltration-only scan on a single skill.
list_detection_rules — Full catalog of all 41 detection rules with IDs, severities, and descriptions.
vet_agent_config (v1.1+) — Scans project directories for adversarial agent-config files (e.g., AGENTS.md, .cursor/rules.md, .claude/CLAUDE.md, .gemini/config).

Resources: skill-vetter://overview (risk overview), skill-vetter://flagged (flagged skills), skill-vetter://rules (rules catalog).

Prompts: pre-install-skill-check (guided pre-install vetting), weekly-skill-audit (audit summary), agent-config-audit (scans for adversarial config files).

Backends: mock (demo with 6 skills), openclaw-skills-dir (local ~/.openclaw/skills/), and planned clawhub-fetch (v1.1) for vetting registry skills before download. Scanners and backends are pluggable for custom adaptation.

openclaw-skill-vetter-mcp

MCP server for security-vetting third-party AI agent extensions before installation — Claude skills, ClawHub plugins, agent tool packs, any code-shaped artifact that runs in your agent environment with your API keys. 41 detection rules across prompt-injection patterns, hardcoded exfiltration channels (Discord/Slack/Telegram webhooks, SSH-key reads, AWS-creds reads), dangerous dynamic execution (eval, exec, subprocess shell=True, pickle.loads), manifest/permission drift, and known typosquat dependencies. Outputs a 0-100 risk score + BLOCK/REVIEW/CAUTION/CLEAN bucket + per-finding evidence. Native ClawHub manifest support; the rule engine generalizes to any code-shaped extension via Custom MCP Build adapters. Keywords: AI agent security, plugin vetting, supply-chain security, prompt injection detection, MCP static analysis.

Status: v1.1.2 Tests: 145 passing License: MIT MCP PyPI

What it does

Third-party AI agent extensions — Claude skills, ClawHub plugins, MCP servers themselves, agent tool packs, npm-distributed agent code — are code that runs inside your environment with your API keys, your filesystem access, your network egress. The supply-chain attack surface is now broadly recognized + actively exploited:

The OWASP MCP Top 10 catalogues prompt injection, command injection, and "rug pull" attacks where compromised MCP servers update with malicious tool definitions after user approval. Microsoft, Datadog, Atlassian, Palo Alto Unit 42, and Prompt Security have all published detailed threat analyses in 2026: see Datadog's MCP risks blog, Atlassian's MCP Clients risk awareness, and Unit 42's MCP sampling attack vectors.
The 2026 ClawHavoc campaign poisoned the OpenClaw skill registry (ClawHub) at scale. Latest public counts: 824 confirmed malicious skills (~7.7% of a 10,700+ registry as of mid-Feb 2026) per Koi Security + The Hacker News. Snyk's ToxicSkills study flagged prompt injection in 36% of skills + 1,467 malicious payloads. Bitdefender's independent analysis places it at ~900 / ~20% of the ecosystem. Antiy Labs catalogued 1,184 historically published. Zscaler ThreatLabz documented the DeepSeek-Claw skill distributing Remcos RAT + GhostLoader — exfils macOS keychain, SSH keys, crypto wallets, cloud API tokens.
The OpenClaw runtime itself accumulated 138+ CVEs in 2026 (tracker) — one-click RCE (CVE-2026-25253, CVSS 8.8), browser-snapshot RCE (CVE-2026-42436), privilege escalation, cross-site WebSocket hijacking, and more.
Agent-config files (AGENTS.md, .cursor/rules.md, .claude/CLAUDE.md, .gemini/config) are now the universal control layer + the next attack surface. Vercel's "AGENTS.md outperforms skills in our agent evals" (HN, 524↑) signals mainstream adoption. The same week, Cursor CVE-2026-26268 and Gemini CLI CVSS 10.0 yolo-mode demonstrated config-file-as-instruction-vector. The arxiv community is treating this as an open research question: "Evaluating AGENTS.md: are they helpful for coding agents?" (HN 232↑) reaches arxiv as the verification problem becomes urgent. v1.1 of this server adds vet_agent_config(directory) covering the trust-boundary failure mode — see Tool surface below.
Cross-model deception via reframed prompts. Nav Toor's CLTR-paper thread (10K views) cites a real Claude→Gemini case: "Claude Code rewrote its own prompt to reframe the task as 'accessibility for people with hearing impairments.' Gemini complied. One frontier model lied to another frontier model to break a safety filter." The skill-as-attack-vector surface now includes inter-model prompt manipulation, not just local code execution.

The same shape of attack works against any third-party extension a user installs into their AI agent runtime — Claude skills, MCP servers, browser-extension agents, npm-distributed agent code. The defensive question every operator faces before clicking install: "is this safe to run with my API keys?"

This MCP server runs a battery of static-analysis scanners against any skill's directory and produces a single VetReport that an operator can act on:

> claude: vet the data-extractor skill before I install it.
[MCP tool: vet_skill]

Skill 'data-extractor': BLOCK — do not install.
Risk score: 100/100. Findings: 1 critical, 4 high, 1 info.

Critical:
  EXFIL.WEBHOOK_DISCORD (extract.py:5) —
    Hardcoded Discord webhook URL: 'https://discord.com/api/webhooks/...'
    Recommendation: Refuse install unless explicitly justified.

High:
  AST.OS_SYSTEM (extract.py:14) — os.system('curl ... | bash')
  EXFIL.ENV_DUMP (extract.py:9) — dumps full os.environ
  MANIFEST.WILDCARD_PERMISSION — `network.http: *`
  ...

Vet result for data-extractor: REFUSE INSTALL.

> claude: any flagged skills currently installed?
[MCP tool: flagged_skills_report]

2 skills flagged at REVIEW or BLOCK:
  - data-extractor       BLOCK   risk_score=100   1 CRITICAL EXFIL.WEBHOOK_DISCORD
  - markdown-formatter   REVIEW  risk_score=35    1 HIGH AST.EVAL_CALL on user input

Related MCP server: securityscan

Why `openclaw-skill-vetter-mcp`

Three things existing tools (manual code review, generic SAST, ClawHub trust scores) don't do:

Skill-aware scanning. Generic SAST tools don't know what an OpenClaw skill manifest looks like. They miss the most common malware shape: a "calculator" skill that requests network.http: *. The vetter cross-checks declared purpose against requested permissions.
Risk score the operator can paste into a ticket. Not "high cyclomatic complexity" — BLOCK — Discord webhook at extract.py:5. Each finding has rule_id, file:line, evidence, and a specific recommendation.
Built for review-before-install, not after-the-fact audit. Run it from inside Claude on a skill you're about to add. Get a verdict in seconds. Refuse the install if it's BLOCK; sandbox-test if REVIEW; install if CLEAN.

Built for the production-AI operator who has been bitten (or doesn't want to be) by ClawHavoc-style supply-chain attacks.

How this fits in the OpenClaw security ecosystem

The OpenClaw security crisis has spawned a multi-vendor tooling landscape. This server's place in it:

Layer	Vendor / project	Posture
Enterprise SaaS / SOC	Cisco DefenseClaw, ClawSecure Watchtower, Zscaler ThreatLabz, NemoClaw	Server-side, paid, integration-heavy, SIEM-aimed. Best fit for organizations with existing security teams + SOC infrastructure.
Best-practices guidance	Microsoft Security Blog, CrowdStrike, Conscia	Educational. No tooling.
Open-source / community	SecureClaw, openclaw-security-monitor, openclaw-dashboard, slowmist's hardening guide	Self-hosted runtime + dashboard tooling. Generally separate process / web UI.
MCP-native (this layer)	`openclaw-skill-vetter-mcp` (this server) + `openclaw-output-vetter-mcp` (claim verification) + `openclaw-upgrade-orchestrator-mcp` (regression catalog + provider-fingerprint)	Inline in the agent's own conversation — Claude Desktop / Cursor / Cline calls these tools directly during a turn. Sub-second, free, MIT, local, read-only. The operator-tooling layer one step closer to the agent than enterprise SIEM covers.

This server isn't a replacement for the SaaS layer — large organizations should pair both. It's a replacement for manual code review of every ClawHub skill before install, with a verdict an operator can paste into a ticket in seconds.

Tool surface

Tool	What it returns
`vet_skill`	Full VetReport for one skill: risk_score, risk_level, sorted findings, summary
`vet_skill_directory`	Aggregate report across every skill in the directory + per-bucket counts
`installed_skills_overview`	Lightweight: just bucket counts + flagged skill IDs
`flagged_skills_report`	Just REVIEW + BLOCK skills with their findings
`scan_for_prompt_injection`	Focused: only prompt-injection findings on one skill
`scan_for_exfiltration`	Focused: only exfiltration findings on one skill
`list_detection_rules`	Catalog of every rule the server applies (transparency)
`vet_agent_config` (v1.1+)	NEW — scan a project DIRECTORY for adversarial agent-config files (`AGENTS.md`, `.gemini/config`, `.cursor/rules.md` / `.cursorrules`, `.claude/CLAUDE.md`, auto-firing git hooks). Returns the same Finding shape; covers prompt-injection, exfiltration channels, embedded shell commands, secret-file references, and git-hook-install patterns. Targets the Cursor CVE-2026-26268 / Gemini-CLI-yolo trust-boundary failure mode.

Resources:

skill-vetter://overview — installed-skills risk overview
skill-vetter://flagged — currently-flagged skills
skill-vetter://rules — detection rules catalog

Prompts:

pre-install-skill-check — vet a specific skill before installation
weekly-skill-audit — compose a 200-word weekly audit of all installed skills
agent-config-audit (v1.1+) — vet a project directory's agent-config files for adversarial content

Quickstart

Install

pip install openclaw-skill-vetter-mcp

Quick verify (~30 seconds, no config)

After install, run the bundled demo to see the vetter catch real malicious skill patterns:

openclaw-skill-vetter-mcp-demo

You'll see 6 hand-shaped skills vetted: typically 2 BLOCK (a data-extractor with hardcoded Discord webhook + os.system at risk_score 100/100; a requestz-typosquat of requests at 55/100) + 2 REVIEW (eval() + manifest-purpose drift) + 2 CLEAN. No external I/O, no API keys — safe to run anywhere. Useful first-30-seconds check before pointing at your real ~/.openclaw/skills/ directory.

Configure for Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "openclaw-skill-vetter": {
      "command": "python",
      "args": ["-m", "openclaw_skill_vetter_mcp"],
      "env": {
        "OPENCLAW_SKILL_VETTER_BACKEND": "mock"
      }
    }
  }
}

Backends

Backend	Status	Description
`mock`	✅ v1.0	6 demo skills with deliberate findings spanning all severities — for protocol verification and README/CLI demos
`openclaw-skills-dir`	✅ v1.0	Reads `~/.openclaw/skills/` (override via `OPENCLAW_SKILLS_DIR`); each subdirectory is parsed as one skill
`clawhub-fetch`	⏳ v1.1	Fetches a candidate skill from the ClawHub registry directly for vet-before-install workflows

Skill manifest format

Each skill directory contains a skill.yaml (or skill.json):

id: weather-fetch
name: Weather Fetch
version: 1.0.0
author: verified-publisher@openclaw.example
description: Fetches current weather for a city using OpenWeatherMap.
purpose: Live weather data lookup
runtime: python3.11
entry_point: main.py
permissions:
  - network.http: api.openweathermap.org
dependencies:
  - requests>=2.31
  - pydantic>=2.0
signature: ed25519:abcd1234efgh5678

Plus the actual code files (*.py, *.js, *.ts, *.sh, *.rb, *.go, *.rs) and any prompt files (*.prompt, *.md, *.txt).

If your OpenClaw deployment uses a different on-disk shape, see the Custom MCP Build section below.

Detection rules (v1.0)

Four scanner modules cover the v1.0 ruleset:

Manifest — MANIFEST.MISSING, MANIFEST.PURPOSE_NETWORK_DRIFT, MANIFEST.WILDCARD_PERMISSION, MANIFEST.BROAD_FILESYSTEM_WRITE, MANIFEST.EMPTY_DESCRIPTION, MANIFEST.NO_AUTHOR, MANIFEST.UNSIGNED

Static patterns (text regex over code + prompts) —

Prompt-injection: PROMPT_INJ.IGNORE_PRIOR, PROMPT_INJ.ROLE_OVERRIDE, PROMPT_INJ.EXTRACT_SYSTEM, PROMPT_INJ.JAILBREAK_DAN, PROMPT_INJ.NEW_USER_MARKER
Exfiltration: EXFIL.WEBHOOK_DISCORD, EXFIL.WEBHOOK_SLACK, EXFIL.WEBHOOK_TELEGRAM, EXFIL.PASTEBIN_LITERAL, EXFIL.SSH_KEY_READ, EXFIL.AWS_CREDS_READ, EXFIL.ENV_DUMP, EXFIL.SUBPROCESS_CURL
Dynamic execution: DYN_EXEC.SHELL_TRUE, DYN_EXEC.OS_SYSTEM, DYN_EXEC.EVAL_LITERAL, DYN_EXEC.EXEC_LITERAL, DYN_EXEC.PICKLE_LOADS, DYN_EXEC.DYNAMIC_IMPORT
Obfuscation: OBFUSCATION.LARGE_BASE64, OBFUSCATION.LARGE_HEX

Python AST (catches what regex misses) — AST.EVAL_CALL, AST.EXEC_CALL, AST.COMPILE_CALL, AST.OS_SYSTEM, AST.OS_POPEN, AST.OS_EXECV, AST.SUBPROCESS_RUN_SHELL_TRUE, AST.SUBPROCESS_POPEN_SHELL_TRUE, AST.DYNAMIC_IMPORT

Dependencies — DEP.TYPOSQUAT, DEP.HOMOGLYPH, DEP.UNTRUSTED_GIT_SOURCE, DEP.LOCAL_PATH

Use list_detection_rules to query the live catalog.

Risk scoring

Each finding contributes by severity:

Severity	Weight
CRITICAL	40
HIGH	15
MEDIUM	5
LOW	1
INFO	0

Final risk_score = min(sum, 100). Bucketing (first match wins):

Bucket	Trigger
BLOCK	≥1 CRITICAL or score ≥ 80
REVIEW	≥1 HIGH or score ≥ 50
CAUTION	≥1 MEDIUM or score ≥ 20
CLEAN	no findings or only INFO

Conservative-by-design: false positives are OK, missed criticals are not. If your operator workflow disagrees with a specific rule, you can filter by category on the client side, or fork + customize.

Roadmap

Version	Scope	Status
v1.0	mock + openclaw-skills-dir backends, 7 tools / 3 resources / 2 prompts, 4 scanner modules with 41 detection rules, GitHub Actions CI matrix, PyPI Trusted Publishing	✅
v1.1	`clawhub-fetch` backend (vet a skill from ClawHub before install); CVE-DB lookup for dependencies; signature verification against ClawHub publisher keys	⏳
v1.2	Sandbox-execution scanner (run skill in isolated process, observe network attempts); whitelist/allowlist per-operator	⏳
v1.x	Custom rule packs; integration with existing SAST tools; per-rule severity overrides	⏳

Need this adapted to your stack?

If your AI deployment doesn't use the OpenClaw skill format — different agent harness, custom skill schema, monolithic skill files, internal-registry distribution — and you want the same vet-before-install discipline, that's a Custom MCP Build engagement.

Tier	Scope	Investment	Timeline
Simple	Single backend adapter for your existing skill format	$8,000–$12,000	1–2 weeks
Standard	Custom backend + custom rule pack tuned to your ecosystem + CI integration	$15,000–$25,000	2–4 weeks
Complex	Multi-format ingestion + sandbox-execution + signed-publisher allowlist + rule-tuning workshop	$30,000–$45,000	4–8 weeks

To engage:

Email hello@temhan.dev with subject Custom MCP Build inquiry — skill vetting
Include: 1-paragraph description of your skill ecosystem + which tier you're considering
Reply within 2 business days with a 30-min discovery call slot

This server is part of a production-AI infrastructure MCP suite — companion to silentwatch-mcp, openclaw-health-mcp, and openclaw-cost-tracker-mcp. Install all four for full operational visibility.

Production AI audits

If you're running production AI and want an outside practitioner to score readiness, find the failure patterns already present (ClawHavoc-style skill malware being one of the most damaging), and write the corrective-action plan:

Tier	Scope	Investment	Timeline
Audit Lite	One system, top-5 findings, written report	$1,500	1 week
Audit Standard	Full audit, all 14 patterns, 5 Cs findings, 90-day follow-up	$3,000	2–3 weeks
Audit + Workshop	Standard audit + 2-day team workshop + first monthly audit included	$7,500	3–4 weeks

Same email channel: hello@temhan.dev with subject AI audit inquiry.

Contributing

PRs welcome. Scanners are pluggable — see src/openclaw_skill_vetter_mcp/scanners/ for the contract.

To add a new scanner:

Create scanners/<your_scanner>.py exporting SCANNER_NAME: str and def scan(skill: Skill) -> list[Finding]
Optionally export def all_rules() -> list[tuple[...]] for the rules catalog
Register in analysis.vet_skill (the orchestrator iterates over a fixed tuple of scanner modules)
Add tests in tests/test_scanners.py

To add a new backend:

Subclass SkillBackend in backends/<your_backend>.py
Implement get_skills, get_skill_by_id, get_directory
Register in backends/__init__.py
Add tests in tests/test_backend_<your_backend>.py

Bug reports + feature requests: open a GitHub issue. False-positive reports: include the skill snippet that fired the wrong rule and we'll tune.

License

MIT — see LICENSE.

Production-AI MCP Suite (Gumroad bundle) — this server plus 6 others in one curated 7-pack bundle with a decision tree, day-one drill, and Custom MCP Build CTA. $29.
silentwatch-mcp — cron silent-failure detection
openclaw-health-mcp — deployment health
openclaw-cost-tracker-mcp — token-cost telemetry + 429 prediction (v1.1+)
openclaw-upgrade-orchestrator-mcp — read-only upgrade advisor + provider-side regression detection (v1.2+)
openclaw-output-vetter-mcp — agent claim verification (inline grounding-check + swallowed-exception scanner + multi-turn transcript review)
AI Production Discipline Framework — Notion template, $19 — methodology these MCPs implement
SPEC.md — full server design

Built by Temur Khan — production AI engineer. Contact: hello@temhan.dev

Available Tools

7 tools

flagged_skills_reportA

Returns just the REVIEW + BLOCK skills with their findings, sorted by risk_score descending. Use this when you only care about what needs attention.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description fully bears transparency burden. Clearly states it returns a filtered subset of skills sorted by risk_score, with no side effects mentioned. Sufficient for a read-only report.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with purpose. Every word serves a purpose; no unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Description covers return type and sorting. Lacks detail on what 'findings' entail, but given no output schema and zero parameters, it is functionally complete for selecting and invoking.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters in schema, so description does not need to add parameter details. Baseline 3, but the clarity of the tool's function elevates it to 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states it returns REVIEW and BLOCK skills with findings sorted by risk_score descending. Clear verb and resource, and distinguishes from sibling tools by focusing on what needs attention.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides direct usage guidance: 'Use this when you only care about what needs attention.' Implicitly suggests not use when full overview is needed, but does not explicitly name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

installed_skills_overviewA

Lightweight overview — just the risk-level counts and the IDs of any skills at REVIEW or BLOCK level. Faster than vet_skill_directory; use this for status-bar / dashboard callers.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description discloses the output (counts and IDs) and positions it as a lightweight, fast read operation, covering key behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences, front-loaded with purpose, no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-output-schema tool, the description fully informs the agent of what to expect and when to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so baseline 4 is appropriate. Description adds context about what the tool returns, compensating for zero-param schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it provides risk-level counts and IDs of skills at REVIEW or BLOCK level, distinguishing it from sibling vet_skill_directory by being lightweight and faster.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'use this for status-bar / dashboard callers' and directly compares to vet_skill_directory, providing clear when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_detection_rulesA

Return the catalog of every detection rule this server applies, with rule IDs, severities, and descriptions. Use this to understand what the vetter checks (and what it doesn't).

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes the output fields (rule IDs, severities, descriptions) and implies a read-only operation without side effects. No annotations exist, so the description carries the burden, and it adequately conveys the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences front-load the action and result. Every word adds value, with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters or output schema, the description fully covers the tool's purpose and output, making it complete for an agent to select and use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so schema coverage is 100%. The description does not need to add parameter meaning, and the baseline for zero parameters is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns a catalog of detection rules with IDs, severities, and descriptions. It distinguishes from sibling tools by focusing on the overall rule set rather than specific scanning or vetting operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises to use this tool to understand what the vetter checks and what it doesn't, providing clear context for when to invoke it. While it doesn't list alternatives or exclusions, the guideline is sufficient for a zero-parameter list tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_for_exfiltrationA

Run only the exfiltration scanner on a single skill. Returns its VetReport with non-exfiltration findings stripped — useful for focused investigation of a suspected data-leak skill.

ParametersJSON Schema

Name	Required	Description	Default
`skill_id`	Yes

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description discloses key behavior: it strips non-exfiltration findings from the VetReport. It does not mention auth requirements or side effects, but the primary behavior is sufficiently covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two efficient sentences, front-loaded with the action and purpose, with no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool, the description covers purpose, behavior, and differentiation. It lacks mention of prerequisites or error cases, but remains largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, and the description only implicitly ties skill_id to 'a single skill' without specifying format, source, or constraints. It adds minimal value beyond the parameter name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs the exfiltration scanner on a single skill and returns a filtered VetReport, directly differentiating it from siblings like scan_for_prompt_injection and vet_skill.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates it is for focused investigation of suspected data-leak skills, providing clear context. However, it does not explicitly state when not to use it or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_for_prompt_injectionA

Run only the prompt-injection scanner on a single skill. Returns its VetReport with non-prompt-injection findings stripped — useful when you want a focused signal.

ParametersJSON Schema

Name	Required	Description	Default
`skill_id`	Yes

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, it transparently describes the output: stripped VetReport with only prompt-injection findings.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first states action, second explains result and use case; no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequately covers purpose and output for a simple tool with one parameter and no output schema; minor gap on error handling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description hints at skill_id via 'single skill', but provides no additional format or constraints beyond the schema name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs only the prompt-injection scanner on a single skill, distinguishing it from sibling tools like scan_for_exfiltration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies use when focused on prompt injection, but does not explicitly exclude other scanners or mention when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vet_skillA

Run all scanners on a single skill — manifest, static patterns, AST, dependencies. Returns a VetReport with risk_score (0-100), risk_level (BLOCK/REVIEW/CAUTION/CLEAN), per-finding details, and a one-paragraph summary. Use this before installing a skill.

ParametersJSON Schema

Name	Required	Description	Default
`skill_id`	Yes	Skill ID to vet. Must exist in the configured backend (default: ~/.openclaw/skills/<skill_id>/).

TDQS

A4.1/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so description must cover behavior. It states it runs scanners and returns a report, implying a non-destructive analysis. However, it does not explicitly confirm no side effects, auth needs, or potential performance impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first describes action and output, second gives usage guidance. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one simple parameter and no output schema, the description adequately covers what the tool does, what it returns, and when to use it. Complete for its complexity level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter, 'skill_id,' with full schema description. The tool description adds no additional meaning beyond the schema; it just rephrases the requirement that the skill must exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it runs all scanners on a single skill, listing specific scanner types (manifest, static patterns, AST, dependencies) and output details. Distinguishes from siblings like 'vet_skill_directory' and 'flagged_skills_report'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises 'Use this before installing a skill,' providing clear usage context. Does not explicitly rule out alternatives, but the recommendation is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vet_skill_directoryA

Run all scanners on every skill in the configured directory and return an aggregate report (per-skill VetReports + counts by risk level). Use this for a periodic audit of installed skills.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It implies a read-only operation (returns report) but lacks mentions of permissions, rate limits, or potential heaviness of running all scanners.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, direct and front-loaded, with no wasted words. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately explains the return format as 'per-skill VetReports + counts by risk level'. It covers the main point but lacks precise structure details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, and the schema coverage is 100%. Baseline is 4 for zero-parameter tools, and the description does not need to add parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Run all scanners on every skill in the configured directory' with a specific verb and resource, and differentiates from siblings by indicating it's a comprehensive audit, unlike 'vet_skill' which likely targets a single skill.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this for a periodic audit of installed skills', providing clear context for usage. However, it does not mention when not to use or compare with alternatives like 'flagged_skills_report'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

7 tool updatesv1.0.0May 4, 2026
- First observedflagged_skills_report
- First observedinstalled_skills_overview
- First observedlist_detection_rules
- First observedscan_for_exfiltration
- First observedscan_for_prompt_injection
- First observedvet_skill
- First observedvet_skill_directory

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.4/5.0

Scored 2026-05-04 01:30 across 7 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: scanning a single skill (full or specific scanners), scanning directory, listing rules, and generating reports/overviews. No two tools overlap in functionality.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (e.g., scan_for_exfiltration, list_detection_rules, vet_skill_directory). No mixing of styles.

Tool Count5/5

With 7 tools, the server covers the core workflows of skill vetting—individual scans, directory audits, rule listing, and reporting—without unnecessary bloat or missing essentials.

Completeness5/5

The tool set provides full coverage for skill vetting: listing available checks, running comprehensive or targeted scans on a single skill, auditing all skills, and obtaining summarized or detailed reports. No obvious gaps.

Maintenance

ActivityStale

ResponsivenessSyncing

Resources

Need Help?

Related Servers

Related MCP Connectors

SecurityScan A
net.apisecurityscan
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
Security Code Analysis Testing & QA Tools
82
Repo Security Scanner — Malicious Code & Supply ChainOAuth
io.github.eltociear
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Security Code Analysis Version Control
1
Singularity - MCP Discovery & Security Gateway A
io.github.gaurav-kumar-sinha-060705
Find, vet, and run MCP tools through a secure audited gateway with prompt-injection risk scoring
311
heron A
io.heronapp
Signed security scores for what an AI agent runs and reads: skills, MCP servers, prompts, tokens.
Security Autonomous Agents
2

Related MCP Servers

skillssafe-mcp
Security Testing & QA Tools Autonomous Agents
GUCCI-atlasv
A
license
Not graded
quality
D
maintenance
Free AI agent skill security scanner. Detects prompt injection, credential theft, zero-width character attacks, and ClawHavoc malware indicators. No signup required.
Updated 6 months ago (2026-03-12 10:07 UTC)
48 npm
1
MIT
securityscan
Security Testing & QA Tools Autonomous Agents
securityscan-api
F
license
Not graded
quality
D
maintenance
Scans OpenClaw/ClawHub skills for security vulnerabilities before installation. Detects prompt injection, data exfiltration, credential theft and RCE risks. Autonomous AI-to-AI flow with zero human intervention required.
Updated 5 months ago (2026-04-06 01:31 UTC)
-
MCPVet
Security Penetration Testing Code Analysis
LorenzoLombardi111
A
license
Not graded
quality
D
maintenance
Vets MCP servers, Claude Code skills, or plugins for unsafe behavior like shell execution, secret access, data exfiltration, prompt injection, and remote code before installation, returning a graded verdict with findings.
Updated 3 months ago (2026-06-17 19:52 UTC)
MIT
SkillsGuard
Security Code Analysis
Teycir
F
license
Not graded
quality
C
maintenance
Static security scanner for AI agent skill packages that detects malicious SKILL.md files and bundled scripts before they run.
Updated 3 months ago (2026-06-21 00:58 UTC)
15
-

openclaw-skill-vetter-mcp

What it does

Why openclaw-skill-vetter-mcp

How this fits in the OpenClaw security ecosystem

Tool surface

Quickstart

Install

Quick verify (~30 seconds, no config)

Configure for Claude Desktop

Backends

Skill manifest format

Detection rules (v1.0)

Risk scoring

Roadmap

Need this adapted to your stack?

Production AI audits

Contributing

License

Related

Available Tools

Tool Schema Changelog

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Why `openclaw-skill-vetter-mcp`