Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-03
This skill is a documentation-only checklist that tells an AI agent how to review other skills before installing them. It contains no scripts or executable code \u2014 just a Markdown guide with a red-flag list, a permission-scope checklist, a risk table, and a template for a vetting report. The only commands it suggests are three read-only `curl` calls to GitHub's public API and raw.githubusercontent.com to look up a repository's star count, file list, and SKILL.md text. It does not ask for credentials, does not write files, does not install anything, and does not contact any unusual servers. Mentions of `base64`, `eval()`, and `exec()` appear only inside the list of warning signs to look for in other skills, not as code that runs. The main residual risk is generic: if the agent fetches another skill's text via the suggested curl commands, that fetched text is untrusted and could contain prompt-injection, which the skill card itself acknowledges.
Instructions try to steer the agent beyond the declared purpose. No instructions in this package attempt to override the agent's rules. However the workflow itself pulls remote third-party text into the agent's context: SKILL.md line 118 'curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"'. The skill card acknowledges this at line 22: 'Mitigation: Treat downloaded skill text as untrusted content and review it before installation or execution.' Fetched skill text could contain injected instructions.
| Declared purpose | Security-first vetting of AI agent skills before installation: check the source, review all code for red flags, assess permission scope, classify risk, and produce a structured vetting report. |
| Observed behavior | Purely instructional Markdown. Provides checklists and a report template, plus three optional read-only curl commands against api.github.com and raw.githubusercontent.com to inspect a GitHub-hosted skill. No file writes, no credential access, no persistence, no package installation, no obfuscation. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec |
| Verdict, AI | SAFE |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Suggested read-only curl requests to api.github.com (repo stats, file listing) and raw.githubusercontent.com (fetch SKILL.md) at SKILL.md lines 112, 115, 118. Both are well-known public hosts and no data is uploaded. |
| shell | needed | A bash code block (SKILL.md lines 110-119) with curl/jq commands the user may run manually to inspect a repository. Nothing is piped into a shell interpreter. |
| severity | finding |
|---|---|
| info | Read-only network call to GitHub API Outbound request to a public, well-known domain to retrieve repository metadata. No credentials or local data are sent. Consistent with the declared purpose of checking a skill's source reputation. SKILL.md:112 curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}' |
| low | Fetches untrusted remote text into the agent's context The suggested workflow downloads another skill's SKILL.md for review. The downloaded content is third-party and could contain prompt-injection aimed at the reviewing agent. The output is only displayed, not executed, and the skill card flags this risk, but agents should treat fetched text as data, not instructions. SKILL.md:118 curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md" |
3 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.github.com | not in the service index | SKILL.md:112 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| raw.githubusercontent.com | not in the service index | SKILL.md:118 |
| Binaries invoked | base64, bash, curl |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 1 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 138 | e8eb7583355c2ae7… |
_meta.json | 6 | 508858b9c7db8af8… |
skill-card.md | 39 | 669841405e419de1… |
For agents
JSON: https://agenteconomy.report/k/skill-vetter.audit.json · badge: https://agenteconomy.report/k/skill-vetter.audited.svg ·
skill rating: /k/skill-vetter · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: amostra.