Skill doctor
Security-audit agent skills before installing: static scanner (~38 rules for prompt injection, exfiltration, credential access, obfuscation, persistence) + semantic review. Vet new skills, fleet-scan installed ones, harden your own. Works with Claude Code, Codex, Cursor.
npx -y skills add joshphoenix1/skill-security-audit --skill skill-doctorAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- 19 days oldThe repository was created 19 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Diagnose hygiene problems across an installed skill set — routing token cost, vague or missing trigger descriptions, overlapping triggers between skills, and duplicates installed in multiple places. Use when the user asks to tidy, audit, trim, or debug their skills, when skills fire at the wrong time or not at all, or when too many skills are installed.
SKILL.md
2.5 KB, 509 tokens by cl100k_base, as published. Nobody here has run it
Skill Doctor
Skills are routed by their description — loaded at every session start,
matched against every task. At 20+ installed skills the failure modes are
mechanical: vague triggers that never fire (or fire on everything),
overlapping descriptions that make routing a coin flip, duplicates drifting
out of sync, and hundreds of tokens of dead description text. This skill
finds them and fixes them.
Workflow
- Measure. Run
scripts/doctor.py(add--jsonfor machine-readable). It inventories every installed skill across Claude Code/Codex/Cursor/agents dirs and reports: total routing budget (estimated tokens), per-skill description lints, trigger-overlap pairs, and duplicates. - Interpret. The script finds mechanical problems; you decide the cure.
For each finding class:
- Vague/thin triggers (LINT-02/03/04) — rewrite the description as a routing rule: what it does + concrete when-to-use. Good: "Use when the user asks to extract form fields or parse tables from a PDF." Bad: "Helps with documents."
- Overlaps (CONF-01) — read both skills. Either differentiate the descriptions (distinct trigger verbs, distinct scope) or merge the skills if they do the same job.
- Duplicates (DUP-01) — keep one source of truth. Prefer a single install location; symlink others if multiple agents need it.
- Bloat (LINT-05) — move detail from the description into the body.
- Act with consent. Show the user every proposed description rewrite or deletion as a diff before applying it. Never delete a skill without explicit confirmation.
- Re-run
doctor.pyafter fixes to confirm the budget shrank and no MEDIUM findings remain.
Guardrails
- Descriptions are routing rules, not documentation — every rewrite must keep the skill's real trigger scope; don't narrow a skill out of existence.
- Overlap ≠ redundancy: two skills about "review" can be legitimately distinct (code review vs. PR review process). Read before merging.
- Companion to
skill-security-audit: the doctor checks hygiene, the auditor checks safety. Different questions, different tools.
What ships with it: 1 file
9.6 KB alongside SKILL.md, 1 of them executable
scripts/
- doctor.pyruns9.6 KB
Gives 0 of the 12 instructions most debug triage skills give in 509 tokens
Counted across 839 of the 1,149 authors here whose files we hold, read 2026-08-07
- Investigate root cause before proposing any fixin 102 of 839, across 67 files
- Read error messages completelyin 89 of 839, across 49 files
- Create a failing test case before fixingin 84 of 839, across 46 files
- Reproduce the issue consistentlyin 82 of 839, across 41 files
- Change one variable at a timein 82 of 839, across 42 files
- Check recent changesin 74 of 839, across 36 files
- Write the regression test before fixingin 74 of 839, across 40 files
- Fix the root cause not the symptomin 60 of 839, across 45 files
- Implement a single fix at a timein 59 of 839, across 20 files
- Trace data flow backward to the sourcein 50 of 839, across 20 files
- Remove all debug instrumentationin 49 of 839, across 13 files
- Form a single hypothesisin 48 of 839, across 18 files
Said here and by no other author read
- inventory all installed skills across tool directories
- rewrite thin triggers as concrete routing rules
- move detail from description into body
- read overlapping skills before merging or differentiating
- keep one source of truth for duplicate skills
- show proposed changes as a diff before applying
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.