OpenClaw · Skill
Vet Repo
Scan all agent configuration files in a repository for known malicious patterns. Use this when entering an unfamiliar codebase to assess agent-level security risks before trusting the repo's configurations.
Install
Start with the primary install command. Alternate entrypoints are included below for ClawHub and OpenClaw CLI users.
Primary command
clawhub install itsnishi/vet-repoClawHub installer
npx clawhub@latest install itsnishi/vet-repoOpenClaw CLI
openclaw skills install itsnishi/vet-repoDirect OpenClaw install
openclaw install itsnishi/vet-repoWhat this skill does
Scan all agent configuration files in a repository for known malicious patterns. Use this when entering an unfamiliar codebase to assess agent-level security risks before trusting the repo's configurations.
Why it matters
Catches agent-level attack vectors like hook auto-approval, hidden curl|bash chains, and instruction injection that standard code review tools don't check for.
Typical use cases
- Auditing a cloned open-source repo before running its agent setup
- Reviewing a contractor's codebase for injected agent instructions
- Checking for malicious hooks after a pull request modifies .claude/
- Security review before onboarding a new project with MCP integrations
- Catching prompt injection attempts hidden in CLAUDE.md files
Source instructions
vet-repo -- Repository Agent Config Scanner
Scan all agent configuration files in a repository for known malicious patterns. Use this when entering an unfamiliar codebase to assess agent-level security risks before trusting the repo's configurations.
What to do
Run the scanner script against the current project root:
python3 "$SKILL_DIR/scripts/vet_repo.py" "$PROJECT_ROOT"
Where $SKILL_DIR is the directory containing this SKILL.md, and $PROJECT_ROOT is the root of the repository being scanned.
What it scans
.claude/settings.json-- hook configs (auto-approve, stop loops, env persistence).claude/skills/-- all SKILL.md files (hidden comments, curl|bash, persistence triggers).mcp.json-- MCP server configs (unknown URLs, env var expansion, broad tools)CLAUDE.md/.claude/CLAUDE.md-- instruction injection in project config
Output
Structured report with findings grouped by severity (CRITICAL, HIGH, MEDIUM, LOW, INFO) and actionable recommendations for each finding.
When to use
- Before trusting a cloned repository's agent configurations
- After pulling changes that modify
.claude/or.mcp.json - As part of a security review of any codebase with agent integration
Advisory hooks
This repository includes PreToolUse hooks in .claude/settings.json that warn on
dangerous Bash commands (pipe-to-shell, rm -rf /, chmod 777, eval with variables,
base64-to-execution) and sensitive file writes (.ssh/, .aws/, .gnupg/, shell
profiles, settings.json).
These hooks are advisory only -- they produce warning messages but do not block execution. An agent or user can proceed past the warning.
- The hooks are a supplementary signal, not an enforcement layer
- vet-repo is the primary detection mechanism for repo-level threats
- Deterministic blocking requires changing the hook to return
{"decision": "block"}instead of a warning message - See
.claude/settings.jsonfor the current hook definitions