A skill only needs to look like a tool to get installed into a real environment.
About ClawSafe We are not building a scan demo.
We are not building a scan demo.
We are building a pre-install trust decision.
ClawSafe starts from a simple point: users do not really want a flashy score page. They want to know whether a skill deserves installation. That question has to be answered with evidence, not with stars, platform placement, or a polished README.
Why this product exists
AI coding skills are entering workflows faster than trust infrastructure is being built around them. Many skills can read files, make network calls, and execute commands, yet almost none go through a meaningful pre-install trust layer.
Once a skill runs, it may gain filesystem, shell, network, and environment access.
“Open source”, “popular”, or “listed on a platform” is not enough to prove trust.
How we build for that problem
ClawSafe chains static evidence extraction, capability alignment, semantic reasoning, and report generation into one trust workflow. The goal is not to prove everything. It is to produce a defensible install decision fast.
We extract the file tree, sensitive files, artifacts, dependencies, and declared scope first, then reason over those facts instead of starting from a verdict.
The end product is not vague risk language. It is block, review, or cautious allow, with reasons attached.
The same report should be readable by engineering, security, and audit teams without forcing everyone through a full code review.
Principles we keep
01
Evidence matters more than reputation
Platform status, author reputation, and download volume are useful context, but never substitutes for code evidence.
02
Transparency matters more than mystery
A report has to explain why the decision was made instead of ending at a number.
03
Speed matters more than perfection
Pre-install decisions need fast feedback, or teams fall back to trusting by default.
04
Humans still decide
ClawSafe is a risk-decision layer, not a fantasy replacement for human review.
Who maintains it
ClawSafe is built and maintained by the YiSec team. We care about turning real AI-native security decisions into products, not about building a framework that only works inside a research write-up.
Next Action
If you already have a skill to install, review it now.
Do not trust it first. Put it through the system and see what it claims, what it does, and what it tries to bring into your environment.