The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Downloads skill metadata and source code from GitHub (api.github.com, raw.githubusercontent.com) and ClawHub to facilitate security auditing and source verification. These are well-known services for developmental data.
[COMMAND_EXECUTION]: Instructs the agent to utilize system commands and platform utilities (mkdir, clawhub install, cat, find) to create temporary environments and inspect file contents during the vetting process.
[PROMPT_INJECTION]: Analyzes untrusted external data (third-party skill code and metadata ingested via curl and cat), creating a surface for indirect prompt injection. The skill lacks strict data boundaries but mitigates risk by explicitly instructing the agent to treat the ingested content as untrusted and to search for malicious patterns rather than executing instructions within them.

skill-vetter