The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/doctor.py contains a bootstrap function _bootstrap_ane_package that dynamically modifies sys.path to load the ane_package library. It calculates search paths based on the WORK_FOLDER_ROOT environment variable, the script's parent directories, and a hardcoded user home directory path (Path.home() / "OneDrive" / "5 ANE CLAUDE work folder"). This dynamic path manipulation and loading can be exploited if an attacker can influence the environment or user directory structure.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user documents (.docx, .pdf, .md, .txt) to extract "claims" which are then interpolated into prompts for various LLM sub-agents (checkers).
Ingestion points: User-supplied files converted to document.md in Step 1.
Boundary markers: The references/checker-contract.md provides structural instructions and quoting rules for checker agents, but does not use explicit delimiters or "ignore previous instructions" guards around the interpolated claim text.
Capability inventory: Subcommands in scripts/doctor.py and ane_package perform file writes (JSON, Word, HTML) and network searches (Step 4).
Sanitization: No explicit sanitization or filtering of the extracted document text is performed before it is passed to the sub-agents.
[EXTERNAL_DOWNLOADS]: The source and prior checker agents described in references/checkers.md are instructed to perform web searches and fetch external sources to verify claims. While intended for verification, this involves network operations triggered by the content of the processed document. The skill includes a --sensitive flag that correctly disables these network operations for high-security documents.
[COMMAND_EXECUTION]: The skill utilizes several subcommands via scripts/doctor.py (e.g., prepare, prepass, route, recompute) which invoke logic in the ane_package. This represents significant local system activity driven by agent instructions.

deliverable-doctor