---
name: marketplace-trust-vetting-layer
description: OpenClaw skill for governed agent workflows.
---
Marketplace Trust Vetting Layer
Pre-install risk scorer for local OpenClaw skill folders. It reviews package metadata and text-like source files before a user installs a community skill.
What it checks
→ Missing `SKILL.md` and packaging hygiene gaps
→ Shell execution and dynamic-code risk indicators
→ Remote-download/install patterns
→ Destructive command text
→ Prompt-injection/social-engineering language
→ Secret-like assignments with redacted evidence
Usage
```bash
python3 scripts/vet_skill.py --target /path/to/skill --json
python3 scripts/vet_skill.py --self-test --json
```
Output
JSON fields include `ok`, `recommendation`, `risk_score`, `files_scanned`, `files_skipped`, `findings`, and `next_steps`.
Safety
Read-only, stdlib-only, no network, no subprocess, no shell execution, and no secret values printed in findings.
Release evidence
Reviewed in the 2026-06-15 GetAgentIQ warehouse propagation cycle.