Vvettd.
AddSign in

zeroclaw

zeroclaw-labs/zeroclaw/.claude/skills/zeroclawOpen on GitHub
From the author

Help users operate and interact with their ZeroClaw agent instance — through both the CLI (`zeroclaw` commands) and the REST/WebSocket gateway API. Use this skill whenever the user wants to: send messages to ZeroClaw, manage memory or cron jobs, check system status, configure channels or providers, hit the gateway API, troubleshoot their ZeroClaw setup, build from source, or do anything involving the `zeroclaw` binary or its HTTP endpoints. Trigger this even if the user just says things like 'check my agent status', 'schedule a reminder', 'store this in memory', 'list my cron jobs', 'send a message to my bot', 'set up Telegram', 'build zeroclaw', or 'my bot is broken' — these are all ZeroClaw operations.

Compare
Overall score BSecurity severity MediumAssessed Oct 28, 2026Content hash e9f9b21Scope: this assessed content onlyAssessment
AssessmentFile structure 1Findings 1VersionsDisputes

Findings1

Selected finding

Close and return to the list
Medium

References external URL — review for indirect prompt injection risk

SKILL.md No line number found in the scanner's text.
Sets Security severity to Medium

SKILL.md or references/ links to an external web page. That page can change after review and could carry instructions aimed at the model.

What the scanner sawExternal URL(s) detected in SKILL.md — referenced content can change after audit
Found by vettdRule VTD-0088Security categoryCounts toward Security severityContent hash e9f9b21
How to fix

Link to content you control, or to a specific commit or release where the host offers one. Tell the agent to treat fetched pages as reference, not as instructions.

All findings in this fileDispute this finding

1 finding and 1 note