Individual skill
yao-doctor-skill
Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual HTML security report. Use when Codex needs to security-review one skill or a full skill library before install, enablement, or execution. Do not use for generic cleanup, usage estimation, or app-level security review outside skill packages.
skills/yao-doctor-skill/SKILL.md
Source commit 5126d4b5500a2f7d447fbe453297507d200b042e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,326
- Repository last updated
- Oct 14, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
.gitignoreasset · 113 bytesREADME.mddoc · 2,674 bytesSKILL.mdcore · 4,317 bytesSKILL.mdcore · 4,317 bytesagents/interface.yamlasset · 781 bytesbaselines/review-baseline.jsonasset · 551 bytesdocs/example-report/README.mddoc · 208 bytesdocs/example-report/report.htmlasset · 160,403 bytesdocs/example-report/report.jsonasset · 31,228 bytesdocs/example-report/report.mddoc · 9,805 bytesdocs/images/public-example-gallery.pngasset · 662,277 bytesdocs/中文说明.mddoc · 6,327 bytesevals/pressure_suite_cases.jsonasset · 2,845 bytesevals/semantic_config.jsonasset · 620 bytesevals/trigger_cases.jsonasset · 962 bytesmanifest.jsonasset · 502 bytesreferences/detection-taxonomy.mddoc · 7,871 bytesreferences/report-blueprint.mddoc · 2,208 bytesreferences/report-ui-contract.mddoc · 1,562 bytesreferences/security-principles.mddoc · 5,054 bytesreports/open-source-reference-scan.mddoc · 4,546 bytesreports/skill-security-research-20260419.mddoc · 49,075 bytesreports/solution-architecture.mddoc · 4,376 bytesscripts/build_public_example_report.pyruns · 22,476 bytesscripts/render_pressure_eval_report.pyruns · 19,276 bytesscripts/render_security_report.pyruns · 143,116 bytesscripts/run_pressure_eval.pyruns · 9,574 bytesscripts/run_skill_doctor.pyruns · 156 bytesscripts/run_yao_doctor_skill.pyruns · 2,457 bytesscripts/scan_security_skills.pyruns · 103,769 bytesscripts/validate_report_ui_contract.pyruns · 1,546 bytes
Read excerpt
# Yao Doctor Skill
## Boundary
Own this recurring job: security-review skill packages as untrusted code and untrusted instructions, separate broad capability risk from actual unsafe behavior, and produce evidence-backed recommendations before the skills are installed or executed.
Do not route here for:
- generic code security reviews outside skill folders
- skill cleanup, archival, deduplication, or stale-usage analysis
- privacy policy writing without scanning files
- creating a brand-new skill with no security audit need
## Default Workflow