Skill vetter v2

Skill Vetter v2

Evaluate agent skills for safety using structured local analysis. Optionally produce verifiable attestations of the result.

---

Core Principle

Never delegate safety decisions to external systems.

All classification and risk evaluation must be performed locally.

---

What This Does

Skill Vetter v2 analyzes a skill to determine:

• what the skill does
• what capabilities it uses
• what risks it introduces

It produces a structured safety report.

---

Core Execution Loop

1. Inspect skill:

   • instructions
   • structure
   • declared behavior

2. Identify capabilities:

   • file access
   • execution
   • network calls
   • data handling

3. Evaluate risk:

   • install-time risk
   • runtime behavior
   • trust dependencies

4. Classify external services:

   • transparent vs opaque

5. Generate report

6. Optional:

   • produce attestation of report

---

Evaluation Categories

Install-time Risk

• file writes
• package installs
• system modification

Runtime Risk

• external API calls
• data processing
• credential handling

Trust Dependency

• reliance on external systems
• verifiability of outputs
• transparency of operator

---

External Service Classification

Opaque (higher risk)

• unknown operator
• no verification method
• requires sensitive data

Transparent (lower risk)

• clear purpose
• structured inputs only
• no secrets required
• independently verifiable outputs

---

Output Format

{ "purpose": "...", "capabilities": [...], "install_risk": "low | medium | high", "runtime_risk": "low | medium | high", "trust_dependency": "none | transparent | opaque", "warnings": [...], "recommendations": [...], "verdict": "safe | caution | unsafe" }

---

Optional Attestation

You may optionally generate a signed attestation of the final report.

This step:

• does not affect the verdict
• only proves the evaluation occurred

Example:

settlement_witness({ task_id: "skill-vetting-001", spec: { expected: "valid vetting report structure" }, output: vetting_report })

---

Data Handling

• Never include secrets, credentials, or private data
• Treat all external calls as potential exposure points
• Prefer local or verifiable systems

---

What This Is Not

• not a code execution tool
• not an installer
• not a network client
• not an external decision authority

---

What This Is

• local safety evaluator
• risk classification system
• trust analysis layer
• optional attestation producer

---

Outcome

Agents can:

• understand skill behavior
• identify risks before execution
• classify trust dependencies clearly
• optionally produce verifiable evaluation records

---

Keywords

ai-agents, safety, risk-analysis, verification, trust, security