skill-vetter

Security-first skill vetting protocol for AI agents. Use before installing any skill from the platform skill market, skillhub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns to determine whether a skill is safe to install.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable vetting protocol with concrete commands, a clear reject checklist, and a copy-paste report template. The main improvements are de-duplicating the install sections, converting the question-list steps into concrete actions, and adding an explicit recovery path for failed vetting checks.

Suggestions

De-duplicate the skillhub and platform-market install sections: extract the shared 'list and read all files' and cleanup steps into a single post-install inspection block referenced by both sources.

Turn the Step 1 (Source Check) and Step 4 (Permission Scope) question lists into concrete commands or a fillable checklist so every step is actionable rather than interrogative.

Add an explicit feedback loop after Step 3, e.g. 'If a red flag is found, document it and stop; do not retry install' or a re-evaluation path when a flag is borderline, to satisfy the validation-recovery expectation for destructive workflows.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence throughout (no concept padding), but the skillhub and platform-market sections duplicate near-identical 'list and read all files' code blocks and cleanup steps that could be consolidated; not quite the trimmable-minor level of 5.	4 / 5
Actionability	Provides copy-paste-ready commands (skillhub --dir install, find, rm -rf) and a concrete reject checklist plus a fill-in report template, but Steps 1 and 4 are question lists rather than executable steps, leaving minor gaps versus fully executable guidance.	4 / 5
Workflow Clarity	Five clearly sequenced steps with real validation checkpoints (temp-dir preview before real install, reject-if-flags gate, risk-level-gates-action), but no explicit feedback/retry loop for error recovery, which the 5 anchor calls for.	4 / 5
Progressive Disclosure	Well-organized into clear sections (When to Use, Vetting Protocol, Output Format, Trust Hierarchy, Principles) with easy navigation and no nested references, but at ~175 lines with no bundle files it exceeds the under-50-line simple-skill allowance for a 5; the reject list and report template could optionally be split out.	4 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description that clearly states both capability and trigger conditions with concrete source-specific keywords. Minor expansion of the action list and trigger synonyms would push specificity and trigger_term_quality to 5.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions ('Checks for red flags, permission scope, and suspicious patterns to determine whether a skill is safe to install'), but does not enumerate the full vetting surface (e.g., code review, source check, risk classification) found in the body, so it falls short of comprehensive coverage at 5.	4 / 5
Completeness	Explicitly answers both what ('Security-first skill vetting protocol... Checks for red flags, permission scope, and suspicious patterns') and when ('Use before installing any skill from the platform skill market, skillhub, GitHub, or other sources') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Good natural keyword coverage ('installing any skill', 'platform skill market', 'skillhub', 'GitHub', 'sources') that a user would plausibly say, though common synonyms like 'vet', 'review skill', or 'is this skill safe' are absent, keeping it below 5.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (security vetting of skills before install) with distinct source-based triggers and minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: dtyq/magic
Path: backend/super-magic/agents/skills/skill-vetter/SKILL.md
Commit: f9973c5

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.