skill-vetter

Security-first skill vetting protocol for AI agents. Use before installing any skill from the platform skill market, skillhub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns to determine whether a skill is safe to install.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The protocol is highly actionable with concrete commands and a clear five-step sequence, but it is weighed down by full bilingual duplication and repeated command blocks, and its destructive cleanup step lacks an explicit verification checkpoint.

Suggestions

Remove or de-duplicate the  Chinese comment blocks and the near-identical skillhub/platform-market preview command sequences to cut tokens roughly in half.

Add an explicit validation checkpoint before the destructive 'rm -rf /tmp/skillhub-preview/' cleanup (e.g., confirm vetting completed and capture findings first), turning the workflow into a validate-then-proceed loop.

Factor the report template and trust hierarchy into a separate reference file so SKILL.md stays a lean overview with one-level-deep navigation.

Dimension	Reasoning	Score
Conciseness	The body duplicates every section in Chinese via <!--zh--> comment blocks and repeats nearly identical find/cat/rm -rf sequences for the skillhub and platform-market cases; both add tokens that could be tightened without losing clarity.	2 / 3
Actionability	Provides concrete, copy-paste-ready commands — 'skillhub --dir /tmp/skillhub-preview/ install <slug>', 'shell_exec(command="find ... -type f \| sort")', 'rm -rf /tmp/skillhub-preview/' — plus an explicit reject checklist and report template.	3 / 3
Workflow Clarity	Five steps are clearly sequenced with a reject-gate, but the destructive 'rm -rf' cleanup and temp-dir review lack an explicit validate-then-proceed checkpoint or fix/retry feedback loop, which the rubric caps at 2 for destructive operations.	2 / 3
Progressive Disclosure	No bundle files exist and sections are well-organized at one level, but the skill is a long monolithic SKILL.md whose bilingual duplication and inline report template/risk table are content that could be factored into separate files.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, triggers naturally on install-source terms, and explicitly pairs what-it-does with when-to-use it. It is clearly distinct from general-purpose skills and unlikely to conflict.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions — 'Checks for red flags, permission scope, and suspicious patterns to determine whether a skill is safe to install' — rather than vague language.	3 / 3
Completeness	Explicitly answers what ('Checks for red flags, permission scope, and suspicious patterns') and when ('Use before installing any skill from...'), matching the 'Use when...' anchor.	3 / 3
Trigger Term Quality	Covers natural source-specific triggers a user would voice — 'platform skill market, skillhub, GitHub, or other sources' — with good variation rather than a single keyword.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (pre-install security vetting of skills) with distinct install-source triggers unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dtyq/magic
Path: backend/super-magic/agents/skills/skill-vetter/SKILL.md
Commit: 41d7ef4

Reviewed: about 13 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.