The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands (e.g., npm, jq, claude, git) to diagnose the system and apply fixes. It employs advanced mitigations against command injection: it strictly forbids the interpolation of untrusted strings (harvested from files or transcripts) directly into command text, instead requiring separate quoted arguments (jq --arg) or temporary files created with mktemp to prevent shell-level manipulation.
[DATA_EXFILTRATION]: The skill accesses local configuration files (settings.json, .mcp.json) that typically contain sensitive API keys and tokens. It enforces a 'Key-scoped reads only' policy, using jq to extract only the specific non-sensitive fields needed (e.g., permission modes or server keys), while explicitly forbidding the reading of entire files or the exposure of environment variables/secrets.
[PROMPT_INJECTION]: The skill processes user transcripts and external skill definitions, which are high-risk sources for indirect prompt injection. It includes a specific defensive rule: it treats transcript content as untrusted data, using it only for metadata aggregation and explicitly instructing the agent to never follow instructions or execute commands found within that content.
[EXTERNAL_DOWNLOADS]: The skill performs read-only version checks by querying the npm registry (registry.npmjs.org), Homebrew's API, and official Claude download domains. These are trusted services, and the data retrieved is used only for version comparison, not for direct execution.
[PRIVILEGE_ESCALATION]: The skill proposes changes to the agent's permission model (e.g., enabling 'auto mode' and adding read-only allow rules). These findings are categorized as high-sensitivity and are gated behind a separate, explicit user permission prompt that names every change being granted, ensuring the user is fully aware of any widening of the security posture.

doctor