yao-doctor-skill

Audit local and OpenClaw skill libraries for security vulnerabilities and generate an HTML report.

1.3k|143|Updated Apr 6, 2026

Search Tags:#security audit #security review #code audit #skill package #AI workbench

Ready to run

npx skills add https://github.com/yaojingang/yao-open-skills --skill yao-doctor-skill

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: yao-doctor-skill
Source: https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-doctor-skill
Command: npx skills add https://github.com/yaojingang/yao-open-skills --skill yao-doctor-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pypdf, pdfplumber, pdf2image, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a security audit for local skill libraries and AI workbench surfaces, identifying potential risks and unsafe behaviors.

Core Features & Use Cases

Security Audit: Identifies privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior.
Bilingual Reporting: Generates a bilingual HTML audit report with global overview, type-based data analysis, per-module audit opinion cards, and evidence trails.
Auditing Skill Packages and Workbench Surfaces: Scans local skill packages and supported workbench configuration targets, separating capability risk from actual unsafe behavior.
Use Case: Before installing or executing a skill package, use this Skill to ensure it meets security standards and does not introduce risks.

Quick Start

Run run_yao_doctor_skill.py --full-scan in the yao-doctor-skill directory to perform a full scan.

Frequently Asked Questions about yao-doctor-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security audit on an AI skill package before installation?▼

Run a security audit on an AI skill package by executing a full scan script that checks for privacy theft, credential theft, and unsafe execution chains. This process generates an HTML audit report detailing vulnerabilities and evidence trails before installation.

What types of security vulnerabilities are detected during a code audit for AI workbenches?▼

A code audit for AI workbenches detects privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior. The audit separates capability risk from actual unsafe behavior to identify specific security vulnerabilities.

Does the skill package security review require specific Python libraries?▼

Yes, the skill package security review requires a Python environment with pypdf, pdfplumber, and pdf2image libraries installed. These dependencies support the analysis and extraction processes needed to scan configuration targets and generate detailed audit findings.

Can I review local skill libraries and OpenClaw workbench surfaces for unsafe execution chains?▼

Yes, you can review local skill libraries and OpenClaw workbench surfaces for unsafe execution chains. The scanner audits both local and OpenClaw skill libraries, separating capability risk from actual unsafe behavior to ensure security standards are met.

What is the best way to document security review findings for AI workbench surfaces?▼

The best way to document security review findings is by generating a bilingual HTML report. This report includes a global overview, type-based data analysis, per-module audit opinion cards, and evidence trails, providing a visual and comprehensive record of the security review.