AI Component Vetting — AI skill for Claude Code

AI Component Vetting

A Claude Code / Claude.ai skill that vets third-party AI tooling components — MCP servers, hooks, agents, commands, plugins, and skills — for supply-chain risk before you install them, using the same due-diligence logic a bank or hospital's vendor risk team would apply to any new vendor.

Built and maintained by [The Compliant Neuron](https://www.thecompliantneuron.com).

What it does

Ask it about any third-party AI component you're considering installing — "is this MCP legit," "should I install this," or a formal risk assessment request — and it produces a structured scorecard:

RISK TIER: [Critical / High / Medium / Low]

1. Provenance & Maintainer Trust — [score]
2. Permission Scope vs. Need        — [score]
3. Auditability                     — [score]
4. Blast Radius                     — [score]
5. Change Control                   — [score]

COVERAGE LIMITATIONS — what this assessment could not verify
RECOMMENDATION — Install as-is / Install with mitigations / Sandbox first / Do not install

No component passes with an empty Coverage Limitations section — every audit has a boundary, and naming it honestly is what separates real due diligence from a rubber stamp.

Why

Installing a third-party MCP server, hook, or agent means granting it real permissions — filesystem access, network calls, sometimes credentials — often based on nothing more than a marketplace listing's marketing copy. This skill applies the same five-category framework vendor risk teams use in regulated industries (banking, healthcare) to AI tooling specifically: who publishes it, what it actually asks for, whether its behavior can be inspected, what the worst case looks like if it's malicious or just buggy, and how it changes after you trust it once.

Structure

• SKILL.md — the skill definition: trigger conditions, the five-category framework, tiering logic, and process
• scripts/audit_npm_package.sh — automates the npm-specific checks (pu