skilldoctor
Audit AI agent skill installations: broken SKILL.md files, duplicate skills shadowing each other across install roots.
The silent failure mode of agent skills: the same skill installed in two directories — you edit one, the agent loads the other, and the fix "doesn't work". Or a broken one (bad frontmatter, name mismatch) that never triggers, so the model just doesn't use it — with no error anywhere.
$ skilldoctor scan
scanned 4 skill directories, found 48 skills
DUPLICATES / SHADOWING
brainstorming
-> wins project zcode C:\proj\.zcode\skills\brainstorming
user zcode C:\Users\me\.zcode\skills\brainstorming
project-level skills shadow user-level ones in agents that document precedence
BROKEN
some-skill (C:\Users\me\.claude\skills\some-skill)
- name 'different-name' != directory 'some-skill'
skilldoctor scan— every layout it knows (project + user):.claude/skills,.codex/skills,.agents/skills,.zcode/skills,.cursor/skills. Exit 1 if anything is wrong: CI-gateable. Conflicts come with a reason and, where the agent documents precedence, the marked winner.skilldoctor check <skill-dir>— validate one skill: frontmatter present, name matches the directory, kebab-case, description present and under 1024 chars.
The checks are deliberately mechanical — every one of them corresponds to a real "skill silently doesn't load" failure. --json everywhere. Python 3.11+, stdlib only.
Precedence honesty: where an agent documents project over user, the winner is marked. Where precedence between roots is undocumented (.claude vs .agents), skilldoctor reports the duplicate and refuses to guess — that guess is how edits get lost.
Install: pip install agent-skilldoctor — or from this repo:
pip install "git+https://github.com/juzorei/skilldoctor#subdirectory=tools/skilldoctor"
The companion agent skill lives in skills/skill-hygiene-audit: how to read the report, dedupe without losing local edits (diff before delete), fix the broken copies, and re-scan after every install. Skills: npx skills add juzorei/skilldoctor.
Metadata
Release files for agent-skilldoctor 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| agent_skilldoctor-0.1.0.tar.gz | 7.3 kB | With provenance | Details for agent_skilldoctor-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| agent_skilldoctor-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for agent_skilldoctor-0.1.0-py3-none-any.whl |
Total release size: 14.6 kB
Release files / agent_skilldoctor-0.1.0.tar.gz
| Download URL | agent_skilldoctor-0.1.0.tar.gz |
|---|---|
| Size | 7.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f9a601f855945f83bcd971f30c812e3cb6002477c853d02dd6ab42add33f7a30
|
|
BLAKE2b-256 checksum How to use checksums |
4a314230defcdf1452899f501beb3c9682dd64567f4b062b55ce8878bd4fb930
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 29, 2026.
Transparency logRelease files / agent_skilldoctor-0.1.0-py3-none-any.whl
| Download URL | agent_skilldoctor-0.1.0-py3-none-any.whl |
|---|---|
| Size | 7.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b830fd7e0b7ff1fdb0f190a5910f2f69e6c67df68c862c9b04e38646c98bb1a8
|
|
BLAKE2b-256 checksum How to use checksums |
3764e585843873a5e015dcb4eabfefacc129842a03644f33e6bde68b6e318727
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 29, 2026.
Transparency logSecurity for agent-skilldoctor 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for agent_skilldoctor-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 29, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.