cco-doctor

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Node.js script doctor.js located within the plugin's installation directory (${CLAUDE_PLUGIN_ROOT}/src/). This is used to verify the health of the plugin installation, versions, and configurations.
  • [INDIRECT_PROMPT_INJECTION]: The skill evaluates and translates the output of the doctor.js script to provide status reports and remediation instructions to the user.
  • Ingestion points: Output from the node ${CLAUDE_PLUGIN_ROOT}/src/doctor.js command.
  • Boundary markers: None specified in the instructions.
  • Capability inventory: The skill has access to Bash and Read tools to perform diagnostics.
  • Sanitization: The instructions direct the agent to translate the output into plain language, but no specific sanitization or escaping of the tool output is mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 05:07 AM