Release
Zeecka/AperiSolve
Cut a new AperiSolve release — bump the version, commit "chore(release): X.Y.Z", tag it, push, and publish a GitHub Release whose notes are computed from the commits since the last tag.
A skill your agent uses when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring…
Install Yao Websecurity Skill
$ npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install yaojingang/yao-open-skills yao-websecurity-skill --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/yao-websecurity-skill .claude/skills/yao-websecurity-skill && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "yao-websecurity-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-websecurity-skill into .claude/skills/yao-websecurity-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-websecurity-skill", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-websecurity-skillType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install yaojingang/yao-open-skills yao-websecurity-skill --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/yao-websecurity-skill .agents/skills/yao-websecurity-skill && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "yao-websecurity-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-websecurity-skill into .agents/skills/yao-websecurity-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-websecurity-skill", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install yaojingang/yao-open-skills yao-websecurity-skill --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/yao-websecurity-skill .cursor/skills/yao-websecurity-skill && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "yao-websecurity-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-websecurity-skill into .cursor/skills/yao-websecurity-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-websecurity-skill", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/yaojingang/yao-open-skills.git --path skills/yao-websecurity-skill--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install yaojingang/yao-open-skills yao-websecurity-skill --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/yao-websecurity-skill .gemini/skills/yao-websecurity-skill && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "yao-websecurity-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-websecurity-skill into .gemini/skills/yao-websecurity-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-websecurity-skill", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install yaojingang/yao-open-skills yao-websecurity-skillInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/yao-websecurity-skill .github/skills/yao-websecurity-skill && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "yao-websecurity-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-websecurity-skill into .github/skills/yao-websecurity-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-websecurity-skill", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install yaojingang/yao-open-skills yao-websecurity-skill --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/yaojingang/yao-open-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/yao-websecurity-skill .opencode/skills/yao-websecurity-skill && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "yao-websecurity-skill" agent skill from https://github.com/yaojingang/yao-open-skills/tree/main/skills/yao-websecurity-skill into .opencode/skills/yao-websecurity-skill/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-websecurity-skill", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
yao-websecurity-skill- GitHub stars
- 1.3k
- Token cost
- ~1.2k tokens
- SKILL.md length
- 519 words
- Files
- 31 (incl. scripts, references)
- Skills in repo
- 16
- Repo updated
- First seen
- Licence
- MIT
At a glance
A skill your agent uses when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring…
- Works in 9 steps: Confirm mode, scope, authorization,… → Prepare an isolated workdir before… → For dynamic-safe, dynamic-active,… → …
- Auditing an authorized website
- SKILL.md covers Use, Required Reading, Workflow and Output Contract, plus 1 more section
- Calls python3 and rg
What it does
Yao Websecurity Skill is an agent skill from yaojingang/yao-open-skills. Use when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring, static review, dynamic review, active validation, or Chinese security reports.
Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 35 other files, including scripts and reference files (for example `README.md`, `agents/interface.yaml` and `evals/semantic_config.json`).
It sits in Security. It works with GitHub. The repository describes itself as: OpenYao public skills collection: reusable AI assets for decision-making, business analysis, tutorials, research evidence gathering, and document generation. The licence is MIT.
When your agent uses it
- Auditing an authorized website
- Local code path
- Owned runtime for security risks
- Vulnerability checklist scoring
Example prompts
- “/yao-websecurity-skill”
Requirements
- Python 3
- Docker
Workflow steps
9 steps, taken from the first numbered list in SKILL.md.
- Confirm mode, scope, authorization, environment, intensity, forbidden actions, test accounts, rate limits, rollback/reset plan, and…
- Prepare an isolated workdir before review: python3 scripts/security_audit_report.py prepare-env --source "" --workdir "" --project ""…
- For dynamic-safe, dynamic-active, hybrid, or online-authorized, configure only temporary secrets, test DB, synthetic accounts/data…
- Inventory the isolated target-source with rg --files, manifests, routes/API definitions, auth/session modules, data models, configs…
- Create the review skeleton: python3 scripts/security_audit_report.py init --project "" --source "/target-source" --mode "" --intensity ""…
- Triage V001-V275 by observed attack surface. Mark irrelevant items Not Applicable with a short reason; deep-audit only applicable or…
- Execute only the selected mode. Static means code/config/passive review. Dynamic-safe means runtime and passive DAST against temp…
- Render artifacts: python3 scripts/security_audit_report.py render --review "/security_review.json" --out-dir "/security-audit-report".
- Return the absolute .xlsx, .html, .md, and .pdf paths, selected mode, selected risk domains, P0/P1 findings, unclear items, coverage gaps…
What it can do on your machine
Read from SKILL.md and the folder at commit 093996e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/, which the agent can run.
Shell commands in SKILL.md call:
python3rg
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Yao Websecurity Skill loads about 1.2k tokens when it runs, and up to ~37k if it reads all its reference files. Until then it costs about 68 tokens; SKILL.md has 519 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from yaojingang/yao-open-skills at commit 093996e, republished under its MIT licence (© yaojingang). 519 words, ~1,198 tokens.
Download SKILL.mdSave it as
.claude/skills/yao-websecurity-skill/SKILL.md (or your agent's skills folder). This skill also uses 30 other files; get the full folder from GitHub.- name
- yao-websecurity-skill
- description
- Use when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring, static review, dynamic review, active validation, or Chinese security reports.
Yao Websecurity Skill
Use
Use when the user gives a local path, archive, GitHub repo, staging URL, or owned runtime and wants a defensive website security audit, vulnerability checklist review, scorecard, remediation plan, static review, dynamic review, active validation, or Excel/HTML/Markdown/PDF report.
Do not use for unauthorized targets, exploit development, credential theft, stealth, malware, third-party public-target scanning, or bypass instructions.
Required Reading
references/security-audit-method.mdreferences/report-contract.mdreferences/review-modes.mdreferences/vulnerability-ontology.csvreferences/scanner-registry.md
Workflow
- Confirm mode, scope, authorization, environment, intensity, forbidden actions, test accounts, rate limits, rollback/reset plan, and whether online targets are allowed. Without active-test authorization, use
static. - Prepare an isolated workdir before review:
python3 scripts/security_audit_report.py prepare-env --source "<path-or-url>" --workdir "<fresh-temp-workdir>" --project "<name>" --mode "<mode>". Local and GitHub targets must be copied or cloned into this fresh temp directory; never install, build, migrate, write reports, or mutate the original source tree. - For
dynamic-safe,dynamic-active,hybrid, oronline-authorized, configure only temporary secrets, test DB, synthetic accounts/data, loopback or isolated containers, OOB endpoint if authorized, and stop conditions. Destructive file operations, DB writes, brute-force resilience, resource pressure, and blind SSRF/OOB tests default to the isolated temp deployment. - Inventory the isolated
target-sourcewithrg --files, manifests, routes/API definitions, auth/session modules, data models, configs, Docker/IaC, CI/CD, and AI/LLM integrations. Record unreadable, generated, vendor, or excluded paths. - Create the review skeleton:
python3 scripts/security_audit_report.py init --project "<name>" --source "<fresh-temp-workdir>/target-source" --mode "<mode>" --intensity "<intensity>" --out "<fresh-temp-workdir>/security_review.json". - Triage
V001-V275by observed attack surface. Mark irrelevant itemsNot Applicablewith a short reason; deep-audit only applicable or unclear items, grouped by domain and priority. Do not spend review budget testing vulnerability families that are not represented in the code, framework, runtime, or deployment model. - Execute only the selected mode. Static means code/config/passive review. Dynamic-safe means runtime and passive DAST against temp deployment. Dynamic-active may run blind/OOB, capped brute-force, file mutation, DB writes, and resource-pressure tests only inside temp deployment unless explicit online authorization states otherwise. If a runtime gate is missing, mark affected checks
UnclearorDeferred, notSafe. - Render artifacts:
python3 scripts/security_audit_report.py render --review "<workdir>/security_review.json" --out-dir "<workdir>/security-audit-report". - Return the absolute
.xlsx,.html,.md, and.pdfpaths, selected mode, selected risk domains, P0/P1 findings, unclear items, coverage gaps, runtime assumptions, and active-test evidence.
Show full SKILL.md (151 more words)Show less
Output Contract
Default outputs are 安全审查评分表.xlsx, 安全审查报告.html, 安全审查报告.md, 安全审查报告.pdf, and security_review.sanitized.json, written outside the audited source tree. Report content is Simplified Chinese by default. Excel must use Chinese labels and Chinese row-level interpretations for verdict, evidence, finding, impact, and remediation, while preserving code identifiers and paths as-is. HTML must include a right-side language toggle with Chinese as the default view and English as the alternate view, plus a sticky top navigation menu for major sections. Markdown is generated from the same Chinese scorecard/report content used by Excel. PDF is a Chinese-first browsing copy optimized for quick review and should use browser/HTML print rendering when available for stable typography and page breaks. Follow references/report-contract.md for review-mode, isolation, and presentation standards. Evidence must be sanitized: no plaintext secrets, cookies, reusable tokens, personal data dumps, or destructive proof steps.
Reference Map
scripts/security_audit_report.py: prepare-env/init/extract/render.templates/review-template.json: review shape.evals/: route boundaries.reports/: reference, output-risk, artifact profiles.
© yaojingang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 30 other files (scripts, references) in skills/yao-websecurity-skill of yaojingang/yao-open-skills.
- SKILL.md
- README.md
- agents/interface.yaml
- evals/semantic_config.json
- evals/trigger_cases.json
- examples/fictional-starbridge-audit/README.md
- examples/fictional-starbridge-audit/security_review.sanitized.json
- examples/fictional-starbridge-audit/安全审查报告.html
- examples/fictional-starbridge-audit/安全审查报告.md
- examples/fictional-starbridge-audit/安全审查报告.pdf
- examples/fictional-starbridge-audit/安全审查评分表.xlsx
- examples/sample-review-note.md
- manifest.json
- references/report-contract.md
- references/review-modes.md
- references/scanner-registry.md
- … and 15 more
Open the folder on GitHubat commit 093996e
Compare with similar skills
Yao Websecurity Skill next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Yao Websecurity Skill this skillyaojingang/yao-open-skills | 1.3k | — | ~1.2k | Automated safety check: Pass | MIT | |
| ReleaseZeecka/AperiSolve | 850 | — | ~1.9k | Automated safety check: Pass | MIT | |
| Triage Codeqlnetdata/netdata | 81k | — | ~1.8k | Automated safety check: Notes | GPL-3.0 | |
| Security AdvisoryMidnightBSD/src | 114 | — | ~2.2k | Automated safety check: Pass | Custom licence | |
| Security Vulnerability Analysiseclipse-ankaios/ankaios | 125 | — | ~1.5k | Automated safety check: Pass | Apache-2.0 | |
| Agentic GitHub Actions Auditortrailofbits/skills | 7.4k | 6 repos | ~5.4k | Automated safety check: Notes | CC-BY-SA-4.0 |
Similar skills
Triage Codeql
netdata/netdata
Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.
Security Advisory
MidnightBSD/src
Handle a security fix end to end for MidnightBSD src - triage a FreeBSD security advisory (FreeBSD-SA-) or CVE against this tree, port the fix to master and both stable branches, add the UPDATING…
Security Vulnerability Analysis
eclipse-ankaios/ankaios
Analyze potential Ankaios security vulnerabilities from pasted reports, local evidence, or advisory URLs.
- Official
Agentic GitHub Actions Auditor
trailofbits/skills
Statically audits GitHub Actions workflows that run AI coding agents, tracing attacker-controlled input to agent prompts and flagging unsafe sandbox, trigger and allowlist settings.
Report Clawhub Malicious Skill
openclaw/clawscan
A skill your agent uses when a researcher, maintainer, or contributor found or suspects a malicious skill on ClawHub and needs a private reporting workflow: opening a GitHub private vulnerability…
More from yaojingang/yao-open-skills
All 16 skills in this repoYao Copyright Skill
yaojingang/yao-open-skills
A skill your agent uses when adding or auditing Yao copyright comment headers for an agent skill package, especially SKILL.md, README.md, references, prompts, templates, examples, scripts, YAML, or…
Yao Crux Skill
yaojingang/yao-open-skills
A skill your agent uses when a user is stuck in a complex real-world situation with many conflicts, limited resources, unclear priorities, or asks to identify the principal contradiction, secondary…
Yao Interpreter Skill
yaojingang/yao-open-skills
Analyze local Agent Skill folders, SKILL.md files, or safe zip archives as untrusted input; explain purpose, trigger contract, structure, usage readiness, safety risks, evidence-backed 100-point…
Yao Positioning Skill
yaojingang/yao-open-skills
Generate evidence-aware positioning reports for personal IPs, courses, products, services, brands, or companies by combining positioning theory, course-marketing analysis, user intent, competitor…
Yao Bayesian Skill
yaojingang/yao-open-skills
Convert uncertain real-world choices into an auditable Bayesian evidence-to-action report with priors, evidence grading, posterior update, action thresholds, sensitivity checks, multi-turn decision…
Yao Business Skill
yaojingang/yao-open-skills
Design, diagnose, and study business models from ideas, product websites, or company names.
Related
Works with
Categories
Questions about Yao Websecurity Skill
What does Yao Websecurity Skill do?
A skill your agent uses when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring…. Yao Websecurity Skill is an agent skill from yaojingang/yao-open-skills. Use when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring, static review, dynamic review, active validation, or Chinese security reports.
When should I use Yao Websecurity Skill?
Yao Websecurity Skill fits situations like: auditing an authorized website; local code path; owned runtime for security risks; vulnerability checklist scoring.
How do I install Yao Websecurity Skill in Claude Code?
Run `npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a claude-code`. Or copy the skill folder (skills/yao-websecurity-skill in yaojingang/yao-open-skills) into .claude/skills/yao-websecurity-skill in your project. Claude Code loads it when a task matches its description.
How do I install Yao Websecurity Skill in Codex?
Run `npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a codex`. Or copy the skill folder (skills/yao-websecurity-skill in yaojingang/yao-open-skills) into .agents/skills/yao-websecurity-skill in your project. Codex loads it when a task matches its description.
Can I use Yao Websecurity Skill in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yaojingang/yao-open-skills --skill yao-websecurity-skill -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/yao-websecurity-skill, .gemini/skills/yao-websecurity-skill, .github/skills/yao-websecurity-skill and .opencode/skills/yao-websecurity-skill in your project.
What does Yao Websecurity Skill need to run?
Going by SKILL.md and its folder, Yao Websecurity Skill needs the command-line tools its instructions call (python3 and rg). Our summary lists: Python 3; Docker.
Does Yao Websecurity Skill access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Yao Websecurity Skill safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Yao Websecurity Skill use?
Yao Websecurity Skill is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Yao Websecurity Skill use?
About 1.2k tokens (SKILL.md is roughly 4.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 36k tokens, read only when the agent opens those files.
What are the alternatives to Yao Websecurity Skill?
Skills that share tags, products or a category with Yao Websecurity Skill: Release (Zeecka/AperiSolve, 850 stars), Triage Codeql (netdata/netdata, 81k stars), Security Advisory (MidnightBSD/src, 114 stars) and Security Vulnerability Analysis (eclipse-ankaios/ankaios, 125 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Yao Websecurity Skill?
yaojingang (a GitHub user) maintains it in yaojingang/yao-open-skills, which has 1,322 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on August 28, 2026.
Source: yaojingang/yao-open-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.