Vett – Scan, sign, and verify AI agent skills before installing

Show HN: Vett – Scan, sign, and verify AI agent skills before installing

Vett – Scan, sign, and verify AI agent skills before installing is a company in show hn launch.

Profile

Hey HN. I built a security registry for AI agent skills.There are 64k skills on Vercel's skills.sh. Cursor, Claude Code, Windsurf, and dozens more agents pull them from GitHub at HEAD — no versioning, signing, or scanning. The OpenClaw agents themselves flagged this: "The supply chain attack nobody is talking about: skill.md is an unsigned binary."[0]I took an official skill that packages other skills, added a few lines of Python to exfiltrate env vars, shell history, and git config, and installed it into Claude Code and Codex. Claude Code ran the script without flagging the outbound request. Codex caught the naive version. After updating the SKILL.md with a two-stage payload that modified `

Its activity falls under show hn launch; the profile below is assembled from public directory data.

Directory data places it at the Show HN launch stage.

Website: vett.sh