Security

Skill Package Doctor

Try it

Audit skill packages before publishing, then generate concrete fixes and a shareable proof card

What it does

Audit skill packages before publishing, then generate concrete fixes and a shareable proof card

The skill document

Skill Package Doctor

Use this skill when the user wants to review, debug, score, publish, or improve an agent skill package.

When To Use

  • A skill folder needs a publish gate before ClawHub, Codex, Claude, or OpenClaw distribution.
  • A generated SKILL.md feels generic, unsafe, too broad, or hard to trust.
  • A builder wants a concrete fix list and a proof card they can share.
  • A marketplace listing needs evidence that the package was checked locally.

Workflow

  1. Locate the target skill folder or SKILL.md.
  2. Run the bundled doctor script when possible:
python3 scripts/skill_doctor.py /path/to/skill \
  --json-out skill-doctor.json \
  --markdown-out skill-doctor.md \
  --svg-out skill-doctor.svg
  1. Read the score, errors, warnings, and fixes.
  2. Patch only the specific issues found. Do not rewrite the skill from scratch unless it is empty or unsafe.
  3. Run the doctor again and compare the score.
  4. Before publish, make sure there are no errors and the score is at least 80.
  5. Read references/source-manifest.json only when you need package provenance or release-surface context.

Review Rules

  • Treat SKILL.md frontmatter as the registry contract.
  • A good description says the task, input, and output in plain words.
  • A useful skill has a clear When To Use trigger, an operating order, and a validation step.
  • Bundled scripts/ and references/ must be mentioned in SKILL.md.
  • Do not allow skill instructions that ask agents to reveal secrets, ignore system instructions, disable safety, or run destructive shell commands.
  • Replace vague wording with concrete inputs, outputs, failure modes, and test commands.
  • Prefer small edits that preserve the builder's intent.

Output

Return:

  • publish decision: publish-ready, ship-after-small-fixes, needs-work, or do-not-publish
  • score out of 100
  • blocking errors first
  • warnings and quick fixes
  • exact files changed
  • proof-card path when generated

Stop Conditions

Do not recommend publishing when:

  • SKILL.md is missing frontmatter, name, or description
  • the body is too short to guide an agent
  • the package contains unexplained scripts
  • the skill asks for secrets, destructive commands, or safety bypasses
  • the stated capability is broader than the files and instructions support

Related skills

Create SVG and Markdown trust cards from skill audits or release metadata

12 installs

Get a structured risk report on a skill package before installing or publishing it.

129 installs

Audit, score, and improve agent skills before publishing, sharing, or installing them. Use when reviewing a SKILL.md file or skill folder for trigger quality...

2 installs

Audit a named ClawHub skill or skill URL before installation by combining OpenClaw verification with bounded static analysis. Use when the user explicitly asks whether a skill is safe or requests a pre-install review; report evidence and uncertainty instead of treating a score as proof.

39 installs

Runtime-neutral skill operations suite. Input a skill directory, slug, marketplace goal, or release plan; output quality checks, safety boundaries, naming/su...

4 installs

Audit a target SKILL.md against the Agent Skills specification and generate a Chinese HTML report. Use when the user asks to check, audit, review, or optimiz...

21 installs