agentsclimarketplace

Skill doctor

Skill joshphoenix1/skill-security-audit/skills/skill-doctor

Security-audit agent skills before installing: static scanner (~38 rules for prompt injection, exfiltration, credential access, obfuscation, persistence) + semantic review. Vet new skills, fleet-scan installed ones, harden your own. Works with Claude Code, Codex, Cursor.

Install
npx -y skills add joshphoenix1/skill-security-audit --skill skill-doctor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 19 days oldThe repository was created 19 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Diagnose hygiene problems across an installed skill set — routing token cost, vague or missing trigger descriptions, overlapping triggers between skills, and duplicates installed in multiple places. Use when the user asks to tidy, audit, trim, or debug their skills, when skills fire at the wrong time or not at all, or when too many skills are installed.

SKILL.md

2.5 KB, 509 tokens by cl100k_base, as published. Nobody here has run it

Skill Doctor

Skills are routed by their description — loaded at every session start, matched against every task. At 20+ installed skills the failure modes are mechanical: vague triggers that never fire (or fire on everything), overlapping descriptions that make routing a coin flip, duplicates drifting out of sync, and hundreds of tokens of dead description text. This skill finds them and fixes them.

Workflow

  1. Measure. Run scripts/doctor.py (add --json for machine-readable). It inventories every installed skill across Claude Code/Codex/Cursor/agents dirs and reports: total routing budget (estimated tokens), per-skill description lints, trigger-overlap pairs, and duplicates.
  2. Interpret. The script finds mechanical problems; you decide the cure. For each finding class:
    • Vague/thin triggers (LINT-02/03/04) — rewrite the description as a routing rule: what it does + concrete when-to-use. Good: "Use when the user asks to extract form fields or parse tables from a PDF." Bad: "Helps with documents."
    • Overlaps (CONF-01) — read both skills. Either differentiate the descriptions (distinct trigger verbs, distinct scope) or merge the skills if they do the same job.
    • Duplicates (DUP-01) — keep one source of truth. Prefer a single install location; symlink others if multiple agents need it.
    • Bloat (LINT-05) — move detail from the description into the body.
  3. Act with consent. Show the user every proposed description rewrite or deletion as a diff before applying it. Never delete a skill without explicit confirmation.
  4. Re-run doctor.py after fixes to confirm the budget shrank and no MEDIUM findings remain.

Guardrails

  • Descriptions are routing rules, not documentation — every rewrite must keep the skill's real trigger scope; don't narrow a skill out of existence.
  • Overlap ≠ redundancy: two skills about "review" can be legitimately distinct (code review vs. PR review process). Read before merging.
  • Companion to skill-security-audit: the doctor checks hygiene, the auditor checks safety. Different questions, different tools.

What ships with it: 1 file

9.6 KB alongside SKILL.md, 1 of them executable

scripts/

Gives 0 of the 12 instructions most debug triage skills give in 509 tokens

Counted across 839 of the 1,149 authors here whose files we hold, read 2026-08-07

  • Investigate root cause before proposing any fixin 102 of 839, across 67 files
  • Read error messages completelyin 89 of 839, across 49 files
  • Create a failing test case before fixingin 84 of 839, across 46 files
  • Reproduce the issue consistentlyin 82 of 839, across 41 files
  • Change one variable at a timein 82 of 839, across 42 files
  • Check recent changesin 74 of 839, across 36 files
  • Write the regression test before fixingin 74 of 839, across 40 files
  • Fix the root cause not the symptomin 60 of 839, across 45 files
  • Implement a single fix at a timein 59 of 839, across 20 files
  • Trace data flow backward to the sourcein 50 of 839, across 20 files
  • Remove all debug instrumentationin 49 of 839, across 13 files
  • Form a single hypothesisin 48 of 839, across 18 files

Said here and by no other author read

  • inventory all installed skills across tool directories
  • rewrite thin triggers as concrete routing rules
  • move detail from description into body
  • read overlapping skills before merging or differentiating
  • keep one source of truth for duplicate skills
  • show proposed changes as a diff before applying

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.