Portable Skill Doctor v0.1.0

Portable Skill Doctor v0.1.0

Audit an Agent Skill before installing, publishing, or migrating it. The bundled Python auditor is read-only toward the target and never executes target scripts.

What it checks

• SKILL.md structure, names, and trigger descriptions
• missing, escaping, encoded, absolute, and machine-specific resource paths
• symlink escapes and unsafe file permissions
• undeclared runtime, tool, permission, and network assumptions
• Codex and GitHub Copilot discovery layouts
• conservative static indicators of execution risk
• unsupported compatibility claims

Outputs

Deterministic text, JSON, or SARIF with stable finding IDs and CI-friendly exit codes.

Install

Preview the pinned release first:

gh skill preview ProfesseurHaipeng/professeur-ai-skills \
  portable-skill-doctor@v0.1.0

Install for Codex:

gh skill install ProfesseurHaipeng/professeur-ai-skills \
  portable-skill-doctor@v0.1.0 \
  --agent codex --scope user

Install for GitHub Copilot:

gh skill install ProfesseurHaipeng/professeur-ai-skills \
  portable-skill-doctor@v0.1.0 \
  --agent github-copilot --scope user

Verification

• 48 unit, adversarial, path, archive, and repository-policy tests passed.
• Python 3.10, 3.12, and 3.13 passed on Ubuntu CI.
• CI, history-based security gates, CodeQL, and the tag-triggered release audit passed.
• Anonymous clean installs from v0.1.0 passed for Codex and GitHub Copilot.
• Both installed copies produced the same auditor SHA-256 and passed strict self-audit.
• Public npx skills discovery and Codex project installation also passed against the release tree on main.

See the repository's tested compatibility record for exact versions and evidence boundaries.

Limits

This is bounded static analysis, not a malware verdict, runtime proof, or replacement for sandboxing and source review. Static rules can produce false positives and false negatives.