vett

Vett provides a critical trust layer for agent skills by thoroughly scanning and verifying code before it executes on a user's machine. Key features include: • Static analysis for code vulnerabilities • Detection of data exfiltration chains • OSV dependency checks for known issues • Sigstore signing for integrity and provenance This platform addresses the inherent security risks of running unverified code directly from sources like GitHub HEAD. Early scans have already identified malicious code disguised as common tools, along with skills silently altering agent configurations post-installation. Vett's two-layer analysis pipeline, combining deterministic static analysis with a large language model evaluation for ambiguous signals, ensures comprehensive threat detection. Every skill undergoes rigorous scrutiny. A setup hook attempting to read sensitive files like `~/.ssh` and exfiltrate credentials is flagged immediately, even if spread across multiple files. For less clear-cut cases, a specialized model compares observed code behavior against the skill's declared purpose, identifying suspicious activities such as a markdown formatter attempting outbound network connections. Vett also implements Sigstore signing with ECDSA P-256 and Rekor transparency logs, ensuring content-addressed immutable storage and protection against tampering. It supports multi-agent synchronization, allowing a single installation to configure for numerous platforms including Claude Code, Cursor, and GitHub Copilot. This makes it an essential tool for developers and engineering teams who need secure, verified agent capabilities without compromising velocity or security.