skill-vetter

Run before installing any third-party Skill: static code analysis + permission checks + third-party dependency audit.

What It Checks

• Static code analysis (malicious code patterns)
• Permission declaration audit (what permissions the skill needs — are they reasonable?)
• Third-party dependency audit (any suspicious packages in the chain?)
• Data exfiltration detection (does it send your code to external servers?)

Strong Recommendation

Make this the first skill you install. Community skill quality varies widely — scanning before installing is basic security hygiene.