yao-doctor-skill

Run a security audit on an AI skill package by executing a full scan script that checks for privacy theft, credential theft, and unsafe execution chains. This process generates an HTML audit report detailing vulnerabilities and evidence trails before installation.

A code audit for AI workbenches detects privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior. The audit separates capability risk from actual unsafe behavior to identify specific security vulnerabilities.

Yes, the skill package security review requires a Python environment with pypdf, pdfplumber, and pdf2image libraries installed. These dependencies support the analysis and extraction processes needed to scan configuration targets and generate detailed audit findings.

Yes, you can review local skill libraries and OpenClaw workbench surfaces for unsafe execution chains. The scanner audits both local and OpenClaw skill libraries, separating capability risk from actual unsafe behavior to ensure security standards are met.

The best way to document security review findings is by generating a bilingual HTML report. This report includes a global overview, type-based data analysis, per-module audit opinion cards, and evidence trails, providing a visual and comprehensive record of the security review.