The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell tools such as git, gh, rsync, cp, ls, and rm. These commands are used to manage local override directories and interact with the repository's configuration.
[DATA_EXFILTRATION]: The skill gathers and transmits environment metadata, including the OS name and version, the current shell environment, GitHub CLI version information, and the user's git configuration name. This information is sent to external platforms (GitHub Discussions and Slack) as part of diagnostic reports.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes content from other repository skills within .claude/skills/. A malicious skill file could contain instructions designed to influence the behavior of the Skill Doctor during its diagnosis or optimization phases.
Ingestion points: Processes repo skill files at .claude/skills/*/SKILL.md.
Boundary markers: None; instructions from analyzed skills are read directly into the agent's context without delimitation.
Capability inventory: Write and delete access to ~/.claude/skills/, GitHub API communication, Slack notification capabilities.
Sanitization: While outbound reports are scrubbed for PII, no inbound sanitization or verification is performed on the instruction content of the skills being analyzed.
[COMMAND_EXECUTION]: The management commands (clone, revert, diff) interpolate user-provided skill names into shell commands targeting ~/.claude/skills/<skill>/ without explicit validation. This creates a risk of path traversal if a user or malicious input provides a path like ../../, potentially allowing unintended file operations outside the scoped directory.

skill-doctor