The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the !command syntax in SKILL.md to execute ${CLAUDE_PLUGIN_ROOT}/bin/ops-doctor at load time. This allows the skill to dynamically populate its context with the output of a local shell command before user interaction.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by processing data from several local sources.
Ingestion points: Reads contents of preferences.json, daemon-health.json, plugin.json, and registry.json via the Read tool, as well as the output of the ops-doctor binary.
Boundary markers: None identified. The diagnostic JSON is interpolated directly into the Agent prompt without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has access to Bash (command execution), Agent (sub-agent spawning), and WebFetch (network operations).
Sanitization: No evidence of sanitization, validation, or escaping of the ingested data before it is passed to the sub-agent.
[COMMAND_EXECUTION]: The skill uses Bash to execute diagnostic scripts and cat to read configuration files. It specifically instructs the agent to verify the "secret resolution chain" which involves checking environment variables and secret management tools like Doppler.
[DATA_EXFILTRATION]: While not performing explicit exfiltration to unknown domains, the skill uses the WebFetch tool to interact with external APIs (e.g., Linear) to test connectivity. This capability, combined with the reading of preferences.json and sensitive environment variables, represents a potential data exposure path if manipulated by malicious diagnostic data.

ops-doctor