Deepsec Documentation Guide
vercel-labs/deepsec
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual…
Install Yao Doctor Skill
$ npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install yaojingang/yao-open-skills yao-doctor-skill --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/yao-doctor-skill .claude/skills/yao-doctor-skill && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "yao-doctor-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-doctor-skill into .claude/skills/yao-doctor-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-doctor-skill", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-doctor-skillType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install yaojingang/yao-open-skills yao-doctor-skill --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/yao-doctor-skill .agents/skills/yao-doctor-skill && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "yao-doctor-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-doctor-skill into .agents/skills/yao-doctor-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-doctor-skill", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install yaojingang/yao-open-skills yao-doctor-skill --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/yao-doctor-skill .cursor/skills/yao-doctor-skill && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "yao-doctor-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-doctor-skill into .cursor/skills/yao-doctor-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-doctor-skill", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/yaojingang/yao-open-skills.git --path skills/yao-doctor-skill--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install yaojingang/yao-open-skills yao-doctor-skill --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/yao-doctor-skill .gemini/skills/yao-doctor-skill && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "yao-doctor-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-doctor-skill into .gemini/skills/yao-doctor-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-doctor-skill", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install yaojingang/yao-open-skills yao-doctor-skillInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/yao-doctor-skill .github/skills/yao-doctor-skill && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "yao-doctor-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-doctor-skill into .github/skills/yao-doctor-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-doctor-skill", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install yaojingang/yao-open-skills yao-doctor-skill --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/yao-doctor-skill .opencode/skills/yao-doctor-skill && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "yao-doctor-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-doctor-skill into .opencode/skills/yao-doctor-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-doctor-skill", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
yao-doctor-skill- GitHub stars
- 1.3k
- Token cost
- ~1.1k tokens
- SKILL.md length
- 437 words
- Files
- 34 (incl. scripts, references)
- Skills in repo
- 16
- Repo updated
- First seen
- Licence
- MIT
At a glance
Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual…
- Works in 6 steps: Run scripts/run_yao_doctor_skill.py… → Scan every discovered skill directory… → For each skill, score two separate layers → …
- Codex needs to security-review one skill
- SKILL.md covers Boundary, Default Workflow, Security Principles and Outputs, plus 1 more section
- A full skill library before install
What it does
Yao Doctor Skill is an agent skill from yaojingang/yao-open-skills. Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual HTML security report. Use when Codex needs to security-review one skill or a full skill library before install, enablement, or execution. Do not use for generic cleanup, usage estimation, or app-level security review outside skill packages.
Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 39 other files, including scripts and reference files (for example `README.md`, `agents/interface.yaml` and `baselines/review-baseline.json`).
It sits in Security, covering Security review. The repository describes itself as: OpenYao public skills collection: reusable AI assets for decision-making, business analysis, tutorials, research evidence gathering, and document generation. The licence is MIT.
When your agent uses it
- Codex needs to security-review one skill
- A full skill library before install
- Generic cleanup
- Usage estimation
Example prompts
- “/yao-doctor-skill”
Workflow steps
6 steps, taken from the first numbered list in SKILL.md.
- Run scripts/run_yao_doctor_skill.py [root] [more-roots].
- Scan every discovered skill directory containing SKILL.md, plus recognized workbench surfaces such as local Codex and Claude configuration…
- For each skill, score two separate layers
- Reuse the incremental cache when possible, and surface per-target diffs plus evidence type and confidence in the final report.
- Generate _yao_doctor_skill_reports//report.html, report.json, and report.md.
- Summarize the highest-severity findings first, with exact paths, lines, evidence type, confidence, and the reason a finding is merely…
What it can do on your machine
Read from SKILL.md and the folder at commit 093996e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/, which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Yao Doctor Skill loads about 1.1k tokens when it runs, and up to ~5.3k if it reads all its reference files. Until then it costs about 114 tokens; SKILL.md has 437 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from yaojingang/yao-open-skills at commit 093996e, republished under its MIT licence (© yaojingang). 437 words, ~1,080 tokens.
Download SKILL.mdSave it as
.claude/skills/yao-doctor-skill/SKILL.md (or your agent's skills folder). This skill also uses 33 other files; get the full folder from GitHub.- name
- yao-doctor-skill
- description
- Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual HTML security report. Use when Codex needs to security-review one skill or a full skill library before install, enablement, or execution. Do not use for generic cleanup, usage estimation, or app-level security review outside skill packages.
Yao Doctor Skill
Boundary
Own this recurring job: security-review skill packages as untrusted code and untrusted instructions, separate broad capability risk from actual unsafe behavior, and produce evidence-backed recommendations before the skills are installed or executed.
Do not route here for:
- generic code security reviews outside skill folders
- skill cleanup, archival, deduplication, or stale-usage analysis
- privacy policy writing without scanning files
- creating a brand-new skill with no security audit need
Default Workflow
- Run
scripts/run_yao_doctor_skill.py [root] [more-roots]. If no roots are provided, auto-discover the current workspace, OpenClaw skill roots, Codex and Claude local skill roots, Codex plugin-cache skills, supported local workbench configuration surfaces, and project-level workbench surfaces such as repoAGENTS.md,CLAUDE.md, or selected.claude/.codexfiles. - Scan every discovered skill directory containing
SKILL.md, plus recognized workbench surfaces such as local Codex and Claude configuration bundles and project-local agent configuration areas. - For each skill, score two separate layers:
- capability risk: what the skill can access or execute
- unsafe behavior: what the skill appears to do with sensitive data or hidden actions
- Reuse the incremental cache when possible, and surface per-target diffs plus evidence type and confidence in the final report.
- Generate
_yao_doctor_skill_reports/<timestamp>/report.html,report.json, andreport.md. Also update the stable entry:- full scans ->
_yao_doctor_skill_reports/full-library-latest/report.html - changed-only scans ->
_yao_doctor_skill_reports/changed-only-latest/report.html
- full scans ->
- Summarize the highest-severity findings first, with exact paths, lines, evidence type, confidence, and the reason a finding is merely risky, suspicious, unsafe, or critical.
Show full SKILL.md (203 more words)Show less
Security Principles
- Do not equate broad permissions with automatic compromise.
- Treat a skill as unsafe only when there is evidence of privacy theft, credential theft, stealthy exfiltration, deceptive behavior, remote execution, or persistence abuse.
- Distinguish capability from intent. A skill may be powerful without being malicious.
- Escalate hard when a sensitive source and an external sink appear in the same execution path or file.
- Favor precise path-level evidence over generic suspicion.
- Stay read-only unless the user explicitly authorizes destructive or quarantine actions.
Outputs
Primary artifact:
- visual HTML security report with the fixed section order:
- overview
- data analysis
- definitions
- module guide
- skill modules
- footer credit
Current interactive contract:
- sticky top navigation
- Chinese default with English toggle
- linked type filters between data analysis and module list
- module cards with audit opinion, findings, and capability evidence
- stable latest report entry for in-app browsing and reuse
Per skill, include:
- absolute path
- declared skill name and one-line summary
- capability risk score and level
- unsafe behavior score and level
- final disposition:
safe,risky,suspicious,unsafe, orcritical - top capabilities discovered
- concrete findings with file path, line, category, severity, rationale, and recommended action
Resources
- Security Principles
- Detection Taxonomy
- Report Blueprint
- Report UI Contract
- Solution Architecture
scripts/scan_security_skills.pyscripts/render_security_report.pyscripts/run_yao_doctor_skill.pyscripts/validate_report_ui_contract.pyevals/trigger_cases.json
© yaojingang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 33 other files (scripts, references) in skills/yao-doctor-skill of yaojingang/yao-open-skills.
- SKILL.md
- .gitignore
- README.md
- agents/interface.yaml
- baselines/review-baseline.json
- docs/example-report/README.md
- docs/example-report/report.html
- docs/example-report/report.json
- docs/example-report/report.md
- docs/images/public-example-gallery.png
- docs/中文说明.md
- evals/pressure_suite
- evals/pressure_suite_cases.json
- evals/semantic_config.json
- evals/trigger_cases.json
- … and 19 more
Open the folder on GitHubat commit 093996e
Compare with similar skills
Yao Doctor Skill next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Yao Doctor Skill this skillyaojingang/yao-open-skills | 1.3k | — | ~1.1k | Automated safety check: Pass | MIT | |
| Deepsec Documentation Guidevercel-labs/deepsec | 8.1k | — | ~956 | Automated safety check: Pass | Apache-2.0 | |
| Kubernetes Network Security Auditkubeshark/kubeshark | 12k | — | ~7.3k | Automated safety check: Notes | Apache-2.0 | |
| Native Dependency Updatemono/SkiaSharp | 5.6k | — | ~4.1k | Automated safety check: Pass | MIT | |
| Semgrep Security Scantrailofbits/skills | 7.5k | — | ~3.7k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Skillward AuditFangcun-AI/SkillWard | 143 | — | ~2.9k | Automated safety check: Pass | Custom licence |
Similar skills
- Official
Kubernetes Network Security Audit
kubeshark/kubeshark
Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.
Native Dependency Update
mono/SkiaSharp
Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.
- Official
Semgrep Security Scan
trailofbits/skills
Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.
Skillward Audit
Fangcun-AI/SkillWard
Security-audit a third-party skill bundle (folder with SKILL.md, or .zip / .tar.gz archive) before installing it, using the SkillWard cloud scanner.
Security Audit
TheDecipherist/claude-code-mastery
Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.
More from yaojingang/yao-open-skills
All 16 skills in this repoYao Copyright Skill
yaojingang/yao-open-skills
A skill your agent uses when adding or auditing Yao copyright comment headers for an agent skill package, especially SKILL.md, README.md, references, prompts, templates, examples, scripts, YAML, or…
Yao Crux Skill
yaojingang/yao-open-skills
A skill your agent uses when a user is stuck in a complex real-world situation with many conflicts, limited resources, unclear priorities, or asks to identify the principal contradiction, secondary…
Yao Interpreter Skill
yaojingang/yao-open-skills
Analyze local Agent Skill folders, SKILL.md files, or safe zip archives as untrusted input; explain purpose, trigger contract, structure, usage readiness, safety risks, evidence-backed 100-point…
Yao Positioning Skill
yaojingang/yao-open-skills
Generate evidence-aware positioning reports for personal IPs, courses, products, services, brands, or companies by combining positioning theory, course-marketing analysis, user intent, competitor…
Yao Bayesian Skill
yaojingang/yao-open-skills
Convert uncertain real-world choices into an auditable Bayesian evidence-to-action report with priors, evidence grading, posterior update, action thresholds, sensitivity checks, multi-turn decision…
Yao Business Skill
yaojingang/yao-open-skills
Design, diagnose, and study business models from ideas, product websites, or company names.
Related
Categories
Questions about Yao Doctor Skill
What does Yao Doctor Skill do?
Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual…. Yao Doctor Skill is an agent skill from yaojingang/yao-open-skills. Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual HTML security report.
When should I use Yao Doctor Skill?
Yao Doctor Skill fits situations like: Codex needs to security-review one skill; A full skill library before install; generic cleanup; usage estimation.
How do I install Yao Doctor Skill in Claude Code?
Run `npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a claude-code`. Or copy the skill folder (skills/yao-doctor-skill in yaojingang/yao-open-skills) into .claude/skills/yao-doctor-skill in your project. Claude Code loads it when a task matches its description.
How do I install Yao Doctor Skill in Codex?
Run `npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a codex`. Or copy the skill folder (skills/yao-doctor-skill in yaojingang/yao-open-skills) into .agents/skills/yao-doctor-skill in your project. Codex loads it when a task matches its description.
Can I use Yao Doctor Skill in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yaojingang/yao-open-skills --skill yao-doctor-skill -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/yao-doctor-skill, .gemini/skills/yao-doctor-skill, .github/skills/yao-doctor-skill and .opencode/skills/yao-doctor-skill in your project.
What does Yao Doctor Skill need to run?
SKILL.md names no scripts, command-line tools or credentials: Yao Doctor Skill is instructions for the agent only.
Does Yao Doctor Skill access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Yao Doctor Skill safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Yao Doctor Skill use?
Yao Doctor Skill is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Yao Doctor Skill use?
About 1.1k tokens (SKILL.md is roughly 4.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 4.2k tokens, read only when the agent opens those files.
What are the alternatives to Yao Doctor Skill?
Skills that share tags, products or a category with Yao Doctor Skill: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Native Dependency Update (mono/SkiaSharp, 5.6k stars) and Semgrep Security Scan (trailofbits/skills, 7.5k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Yao Doctor Skill?
yaojingang (a GitHub user) maintains it in yaojingang/yao-open-skills, which has 1,323 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on August 28, 2026.
Source: yaojingang/yao-open-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.