de en es ja ko ru zh

openclaw-skill-vetter-mcp

Name: openclaw-skill-vetter-mcp
Author: temurkhan13

by temurkhan13

Overview Schema Source Related Servers Discussions Admin

Python

Local

openclaw-skill-vetter-mcp

Vet ClawHub skills before installing them. Detects prompt-injection patterns, hardcoded exfiltration channels, dangerous dynamic execution, manifest/permission drift, and known typosquat dependencies. Outputs a 0-100 risk score + per-finding evidence the operator can paste into a ticket. Companion to silentwatch-mcp, openclaw-health-mcp, and openclaw-cost-tracker-mcp.

Status: v1.0.0 License: MIT MCP PyPI

What it does

ClawHub skills are third-party code. Once installed, they run inside the operator's OpenClaw environment with whatever permissions they were granted. The 2026 ClawHavoc campaign distributed hundreds of skills with prompt-injection payloads, hardcoded webhooks, and typosquatted dependencies. Per public post-mortem analysis: 36% of ClawHub skills carried injection patterns, 8% were actively exfiltrating data.

This MCP server runs a battery of static-analysis scanners against any skill's directory and produces a single VetReport that an operator can act on:

> claude: vet the data-extractor skill before I install it.
[MCP tool: vet_skill]

Skill 'data-extractor': BLOCK — do not install.
Risk score: 100/100. Findings: 1 critical, 4 high, 1 info.

Critical:
  EXFIL.WEBHOOK_DISCORD (extract.py:5) —
    Hardcoded Discord webhook URL: 'https://discord.com/api/webhooks/...'
    Recommendation: Refuse install unless explicitly justified.

High:
  AST.OS_SYSTEM (extract.py:14) — os.system('curl ... | bash')
  EXFIL.ENV_DUMP (extract.py:9) — dumps full os.environ
  MANIFEST.WILDCARD_PERMISSION — `network.http: *`
  ...

Vet result for data-extractor: REFUSE INSTALL.

> claude: any flagged skills currently installed?
[MCP tool: flagged_skills_report]

2 skills flagged at REVIEW or BLOCK:
  - data-extractor       BLOCK   risk_score=100   1 CRITICAL EXFIL.WEBHOOK_DISCORD
  - markdown-formatter   REVIEW  risk_score=35    1 HIGH AST.EVAL_CALL on user input

Related MCP server: securityscan

Why `openclaw-skill-vetter-mcp`

Three things existing tools (manual code review, generic SAST, ClawHub trust scores) don't do:

Skill-aware scanning. Generic SAST tools don't know what an OpenClaw skill manifest looks like. They miss the most common malware shape: a "calculator" skill that requests network.http: *. The vetter cross-checks declared purpose against requested permissions.
Risk score the operator can paste into a ticket. Not "high cyclomatic complexity" — BLOCK — Discord webhook at extract.py:5. Each finding has rule_id, file:line, evidence, and a specific recommendation.
Built for review-before-install, not after-the-fact audit. Run it from inside Claude on a skill you're about to add. Get a verdict in seconds. Refuse the install if it's BLOCK; sandbox-test if REVIEW; install if CLEAN.

Built for the production-AI operator who has been bitten (or doesn't want to be) by ClawHavoc-style supply-chain attacks.

Tool surface

Tool	What it returns
`vet_skill`	Full VetReport for one skill: risk_score, risk_level, sorted findings, summary
`vet_skill_directory`	Aggregate report across every skill in the directory + per-bucket counts
`installed_skills_overview`	Lightweight: just bucket counts + flagged skill IDs
`flagged_skills_report`	Just REVIEW + BLOCK skills with their findings
`scan_for_prompt_injection`	Focused: only prompt-injection findings on one skill
`scan_for_exfiltration`	Focused: only exfiltration findings on one skill
`list_detection_rules`	Catalog of every rule the server applies (transparency)

Resources:

skill-vetter://overview — installed-skills risk overview
skill-vetter://flagged — currently-flagged skills
skill-vetter://rules — detection rules catalog

Prompts:

pre-install-skill-check — vet a specific skill before installation
weekly-skill-audit — compose a 200-word weekly audit of all installed skills

Quickstart

Install

pip install openclaw-skill-vetter-mcp

Configure for Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "openclaw-skill-vetter": {
      "command": "python",
      "args": ["-m", "openclaw_skill_vetter_mcp"],
      "env": {
        "OPENCLAW_SKILL_VETTER_BACKEND": "mock"
      }
    }
  }
}

Backends

Backend	Status	Description
`mock`	✅ v1.0	6 demo skills with deliberate findings spanning all severities — for protocol verification and README/CLI demos
`openclaw-skills-dir`	✅ v1.0	Reads `~/.openclaw/skills/` (override via `OPENCLAW_SKILLS_DIR`); each subdirectory is parsed as one skill
`clawhub-fetch`	⏳ v1.1	Fetches a candidate skill from the ClawHub registry directly for vet-before-install workflows

Skill manifest format

Each skill directory contains a skill.yaml (or skill.json):

id: weather-fetch
name: Weather Fetch
version: 1.0.0
author: verified-publisher@openclaw.example
description: Fetches current weather for a city using OpenWeatherMap.
purpose: Live weather data lookup
runtime: python3.11
entry_point: main.py
permissions:
  - network.http: api.openweathermap.org
dependencies:
  - requests>=2.31
  - pydantic>=2.0
signature: ed25519:abcd1234efgh5678

Plus the actual code files (*.py, *.js, *.ts, *.sh, *.rb, *.go, *.rs) and any prompt files (*.prompt, *.md, *.txt).

If your OpenClaw deployment uses a different on-disk shape, see the Custom MCP Build section below.

Detection rules (v1.0)

Four scanner modules cover the v1.0 ruleset:

Manifest — MANIFEST.MISSING, MANIFEST.PURPOSE_NETWORK_DRIFT, MANIFEST.WILDCARD_PERMISSION, MANIFEST.BROAD_FILESYSTEM_WRITE, MANIFEST.EMPTY_DESCRIPTION, MANIFEST.NO_AUTHOR, MANIFEST.UNSIGNED

Static patterns (text regex over code + prompts) —

Prompt-injection: PROMPT_INJ.IGNORE_PRIOR, PROMPT_INJ.ROLE_OVERRIDE, PROMPT_INJ.EXTRACT_SYSTEM, PROMPT_INJ.JAILBREAK_DAN, PROMPT_INJ.NEW_USER_MARKER
Exfiltration: EXFIL.WEBHOOK_DISCORD, EXFIL.WEBHOOK_SLACK, EXFIL.WEBHOOK_TELEGRAM, EXFIL.PASTEBIN_LITERAL, EXFIL.SSH_KEY_READ, EXFIL.AWS_CREDS_READ, EXFIL.ENV_DUMP, EXFIL.SUBPROCESS_CURL
Dynamic execution: DYN_EXEC.SHELL_TRUE, DYN_EXEC.OS_SYSTEM, DYN_EXEC.EVAL_LITERAL, DYN_EXEC.EXEC_LITERAL, DYN_EXEC.PICKLE_LOADS, DYN_EXEC.DYNAMIC_IMPORT
Obfuscation: OBFUSCATION.LARGE_BASE64, OBFUSCATION.LARGE_HEX

Python AST (catches what regex misses) — AST.EVAL_CALL, AST.EXEC_CALL, AST.COMPILE_CALL, AST.OS_SYSTEM, AST.OS_POPEN, AST.OS_EXECV, AST.SUBPROCESS_RUN_SHELL_TRUE, AST.SUBPROCESS_POPEN_SHELL_TRUE, AST.DYNAMIC_IMPORT

Dependencies — DEP.TYPOSQUAT, DEP.HOMOGLYPH, DEP.UNTRUSTED_GIT_SOURCE, DEP.LOCAL_PATH

Use list_detection_rules to query the live catalog.

Risk scoring

Each finding contributes by severity:

Severity	Weight
CRITICAL	40
HIGH	15
MEDIUM	5
LOW	1
INFO	0

Final risk_score = min(sum, 100). Bucketing (first match wins):

Bucket	Trigger
BLOCK	≥1 CRITICAL or score ≥ 80
REVIEW	≥1 HIGH or score ≥ 50
CAUTION	≥1 MEDIUM or score ≥ 20
CLEAN	no findings or only INFO

Conservative-by-design: false positives are OK, missed criticals are not. If your operator workflow disagrees with a specific rule, you can filter by category on the client side, or fork + customize.

Roadmap

Version	Scope	Status
v1.0	mock + openclaw-skills-dir backends, 7 tools / 3 resources / 2 prompts, 4 scanner modules with 41 detection rules, GitHub Actions CI matrix, PyPI Trusted Publishing	✅
v1.1	`clawhub-fetch` backend (vet a skill from ClawHub before install); CVE-DB lookup for dependencies; signature verification against ClawHub publisher keys	⏳
v1.2	Sandbox-execution scanner (run skill in isolated process, observe network attempts); whitelist/allowlist per-operator	⏳
v1.x	Custom rule packs; integration with existing SAST tools; per-rule severity overrides	⏳

Need this adapted to your stack?

If your AI deployment doesn't use the OpenClaw skill format — different agent harness, custom skill schema, monolithic skill files, internal-registry distribution — and you want the same vet-before-install discipline, that's a Custom MCP Build engagement.

Tier	Scope	Investment	Timeline
Simple	Single backend adapter for your existing skill format	$8,000–$12,000	1–2 weeks
Standard	Custom backend + custom rule pack tuned to your ecosystem + CI integration	$15,000–$25,000	2–4 weeks
Complex	Multi-format ingestion + sandbox-execution + signed-publisher allowlist + rule-tuning workshop	$30,000–$45,000	4–8 weeks

To engage:

Email temur@pixelette.tech with subject Custom MCP Build inquiry — skill vetting
Include: 1-paragraph description of your skill ecosystem + which tier you're considering
Reply within 2 business days with a 30-min discovery call slot

This server is part of a production-AI infrastructure MCP suite — companion to silentwatch-mcp, openclaw-health-mcp, and openclaw-cost-tracker-mcp. Install all four for full operational visibility.

Production AI audits

If you're running production AI and want an outside practitioner to score readiness, find the failure patterns already present (ClawHavoc-style skill malware being one of the most damaging), and write the corrective-action plan:

Tier	Scope	Investment	Timeline
Audit Lite	One system, top-5 findings, written report	$1,500	1 week
Audit Standard	Full audit, all 14 patterns, 5 Cs findings, 90-day follow-up	$3,000	2–3 weeks
Audit + Workshop	Standard audit + 2-day team workshop + first monthly audit included	$7,500	3–4 weeks

Same email channel: temur@pixelette.tech with subject AI audit inquiry.

Contributing

PRs welcome. Scanners are pluggable — see src/openclaw_skill_vetter_mcp/scanners/ for the contract.

To add a new scanner:

Create scanners/<your_scanner>.py exporting SCANNER_NAME: str and def scan(skill: Skill) -> list[Finding]
Optionally export def all_rules() -> list[tuple[...]] for the rules catalog
Register in analysis.vet_skill (the orchestrator iterates over a fixed tuple of scanner modules)
Add tests in tests/test_scanners.py

To add a new backend:

Subclass SkillBackend in backends/<your_backend>.py
Implement get_skills, get_skill_by_id, get_directory
Register in backends/__init__.py
Add tests in tests/test_backend_<your_backend>.py

Bug reports + feature requests: open a GitHub issue. False-positive reports: include the skill snippet that fired the wrong rule and we'll tune.

License

MIT — see LICENSE.

silentwatch-mcp — cron silent-failure detection
openclaw-health-mcp — deployment health
openclaw-cost-tracker-mcp — token-cost telemetry
AI Production Discipline Framework — Notion template, $29 — methodology these MCPs implement
SPEC.md — full server design

Built by Temur Khan — independent practitioner on production AI systems. Contact: temur@pixelette.tech

Available Tools

7 tools

flagged_skills_reportA

Returns just the REVIEW + BLOCK skills with their findings, sorted by risk_score descending. Use this when you only care about what needs attention.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description fully bears transparency burden. Clearly states it returns a filtered subset of skills sorted by risk_score, with no side effects mentioned. Sufficient for a read-only report.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with purpose. Every word serves a purpose; no unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Description covers return type and sorting. Lacks detail on what 'findings' entail, but given no output schema and zero parameters, it is functionally complete for selecting and invoking.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters in schema, so description does not need to add parameter details. Baseline 3, but the clarity of the tool's function elevates it to 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states it returns REVIEW and BLOCK skills with findings sorted by risk_score descending. Clear verb and resource, and distinguishes from sibling tools by focusing on what needs attention.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides direct usage guidance: 'Use this when you only care about what needs attention.' Implicitly suggests not use when full overview is needed, but does not explicitly name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

installed_skills_overviewA

Lightweight overview — just the risk-level counts and the IDs of any skills at REVIEW or BLOCK level. Faster than vet_skill_directory; use this for status-bar / dashboard callers.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description discloses the output (counts and IDs) and positions it as a lightweight, fast read operation, covering key behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences, front-loaded with purpose, no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-output-schema tool, the description fully informs the agent of what to expect and when to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so baseline 4 is appropriate. Description adds context about what the tool returns, compensating for zero-param schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it provides risk-level counts and IDs of skills at REVIEW or BLOCK level, distinguishing it from sibling vet_skill_directory by being lightweight and faster.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'use this for status-bar / dashboard callers' and directly compares to vet_skill_directory, providing clear when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_detection_rulesA

Return the catalog of every detection rule this server applies, with rule IDs, severities, and descriptions. Use this to understand what the vetter checks (and what it doesn't).

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes the output fields (rule IDs, severities, descriptions) and implies a read-only operation without side effects. No annotations exist, so the description carries the burden, and it adequately conveys the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences front-load the action and result. Every word adds value, with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters or output schema, the description fully covers the tool's purpose and output, making it complete for an agent to select and use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so schema coverage is 100%. The description does not need to add parameter meaning, and the baseline for zero parameters is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns a catalog of detection rules with IDs, severities, and descriptions. It distinguishes from sibling tools by focusing on the overall rule set rather than specific scanning or vetting operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises to use this tool to understand what the vetter checks and what it doesn't, providing clear context for when to invoke it. While it doesn't list alternatives or exclusions, the guideline is sufficient for a zero-parameter list tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_for_exfiltrationA

Run only the exfiltration scanner on a single skill. Returns its VetReport with non-exfiltration findings stripped — useful for focused investigation of a suspected data-leak skill.

ParametersJSON Schema

Name	Required	Description	Default
`skill_id`	Yes

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description discloses key behavior: it strips non-exfiltration findings from the VetReport. It does not mention auth requirements or side effects, but the primary behavior is sufficiently covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two efficient sentences, front-loaded with the action and purpose, with no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool, the description covers purpose, behavior, and differentiation. It lacks mention of prerequisites or error cases, but remains largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, and the description only implicitly ties skill_id to 'a single skill' without specifying format, source, or constraints. It adds minimal value beyond the parameter name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs the exfiltration scanner on a single skill and returns a filtered VetReport, directly differentiating it from siblings like scan_for_prompt_injection and vet_skill.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates it is for focused investigation of suspected data-leak skills, providing clear context. However, it does not explicitly state when not to use it or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_for_prompt_injectionA

Run only the prompt-injection scanner on a single skill. Returns its VetReport with non-prompt-injection findings stripped — useful when you want a focused signal.

ParametersJSON Schema

Name	Required	Description	Default
`skill_id`	Yes

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, it transparently describes the output: stripped VetReport with only prompt-injection findings.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first states action, second explains result and use case; no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequately covers purpose and output for a simple tool with one parameter and no output schema; minor gap on error handling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description hints at skill_id via 'single skill', but provides no additional format or constraints beyond the schema name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs only the prompt-injection scanner on a single skill, distinguishing it from sibling tools like scan_for_exfiltration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies use when focused on prompt injection, but does not explicitly exclude other scanners or mention when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vet_skillA

Run all scanners on a single skill — manifest, static patterns, AST, dependencies. Returns a VetReport with risk_score (0-100), risk_level (BLOCK/REVIEW/CAUTION/CLEAN), per-finding details, and a one-paragraph summary. Use this before installing a skill.

ParametersJSON Schema

Name	Required	Description	Default
`skill_id`	Yes	Skill ID to vet. Must exist in the configured backend (default: ~/.openclaw/skills/<skill_id>/).

TDQS

A4.1/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so description must cover behavior. It states it runs scanners and returns a report, implying a non-destructive analysis. However, it does not explicitly confirm no side effects, auth needs, or potential performance impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first describes action and output, second gives usage guidance. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one simple parameter and no output schema, the description adequately covers what the tool does, what it returns, and when to use it. Complete for its complexity level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter, 'skill_id,' with full schema description. The tool description adds no additional meaning beyond the schema; it just rephrases the requirement that the skill must exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it runs all scanners on a single skill, listing specific scanner types (manifest, static patterns, AST, dependencies) and output details. Distinguishes from siblings like 'vet_skill_directory' and 'flagged_skills_report'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises 'Use this before installing a skill,' providing clear usage context. Does not explicitly rule out alternatives, but the recommendation is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vet_skill_directoryA

Run all scanners on every skill in the configured directory and return an aggregate report (per-skill VetReports + counts by risk level). Use this for a periodic audit of installed skills.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It implies a read-only operation (returns report) but lacks mentions of permissions, rate limits, or potential heaviness of running all scanners.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, direct and front-loaded, with no wasted words. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately explains the return format as 'per-skill VetReports + counts by risk level'. It covers the main point but lacks precise structure details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, and the schema coverage is 100%. Baseline is 4 for zero-parameter tools, and the description does not need to add parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Run all scanners on every skill in the configured directory' with a specific verb and resource, and differentiates from siblings by indicating it's a comprehensive audit, unlike 'vet_skill' which likely targets a single skill.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this for a periodic audit of installed skills', providing clear context for usage. However, it does not mention when not to use or compare with alternatives like 'flagged_skills_report'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

7 tool updatesv1.0.0May 4, 2026
- First observedflagged_skills_report
- First observedinstalled_skills_overview
- First observedlist_detection_rules
- First observedscan_for_exfiltration
- First observedscan_for_prompt_injection
- First observedvet_skill
- First observedvet_skill_directory

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.4/5.0

Scored 2026-05-04 01:30 across 7 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: scanning a single skill (full or specific scanners), scanning directory, listing rules, and generating reports/overviews. No two tools overlap in functionality.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (e.g., scan_for_exfiltration, list_detection_rules, vet_skill_directory). No mixing of styles.

Tool Count5/5

With 7 tools, the server covers the core workflows of skill vetting—individual scans, directory audits, rule listing, and reporting—without unnecessary bloat or missing essentials.

Completeness5/5

The tool set provides full coverage for skill vetting: listing available checks, running comprehensive or targeted scans on a single skill, auditing all skills, and obtaining summarized or detailed reports. No obvious gaps.

Maintenance

ActivityStale

ResponsivenessSyncing

Resources

Need Help?

Related Servers

Related MCP Connectors

SecurityScan A
net.apisecurityscan
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
Security Code Analysis Testing & QA Tools
82
Agent Skill & Config Security AuditOAuth
io.github.tylerscomic-lab
Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.
Security Penetration Testing Code Analysis
1
Patronus Security AOAuth
studio.patronus
Scan text, documents, websites, and MCP metadata for prompt injection and sensitive-data risks.
Penetration Testing Security
71
Repo Security Scanner — Malicious Code & Supply ChainOAuth
io.github.eltociear
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Security Code Analysis Version Control
1

Related MCP Servers

skillssafe-mcp
Security Testing & QA Tools Autonomous Agents
GUCCI-atlasv
A
license
Not graded
quality
D
maintenance
Free AI agent skill security scanner. Detects prompt injection, credential theft, zero-width character attacks, and ClawHavoc malware indicators. No signup required.
Updated 7 months ago (2026-03-12 10:07 UTC)
54 npm
1
MIT
securityscan
Security Testing & QA Tools Autonomous Agents
securityscan-api
F
license
Not graded
quality
D
maintenance
Scans OpenClaw/ClawHub skills for security vulnerabilities before installation. Detects prompt injection, data exfiltration, credential theft and RCE risks. Autonomous AI-to-AI flow with zero human intervention required.
Updated 6 months ago (2026-04-06 01:31 UTC)
-
MCPVet
Security Penetration Testing Code Analysis
LorenzoLombardi111
A
license
Not graded
quality
D
maintenance
Vets MCP servers, Claude Code skills, or plugins for unsafe behavior like shell execution, secret access, data exfiltration, prompt injection, and remote code before installation, returning a graded verdict with findings.
Updated 4 months ago (2026-06-17 19:52 UTC)
MIT
SkillsGuard
Security Code Analysis
Teycir
F
license
Not graded
quality
D
maintenance
Static security scanner for AI agent skill packages that detects malicious SKILL.md files and bundled scripts before they run.
Updated 3 months ago (2026-06-21 00:58 UTC)
15
-

openclaw-skill-vetter-mcp

What it does

Why openclaw-skill-vetter-mcp

Tool surface

Quickstart

Install

Configure for Claude Desktop

Backends

Skill manifest format

Detection rules (v1.0)

Risk scoring

Roadmap

Need this adapted to your stack?

Production AI audits

Contributing

License

Related

Available Tools

Tool Schema Changelog

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Why `openclaw-skill-vetter-mcp`