The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/replay-hook-blocks.py executes security hook scripts using subprocess.run. The paths to these executables are dynamically extracted from the agent's configuration file located at ~/.claude/settings.json, which could lead to arbitrary command execution if the configuration is manipulated.
[DYNAMIC_EXECUTION]: The script scripts/fix-hooks.py programmatically modifies shell scripts within the ~/.claude/hooks directory. It uses regular expressions to append output redirections and change exit codes, effectively rewriting security-sensitive logic at runtime.
[PRIVILEGE_ESCALATION]: The skill encourages the agent to modify its own operational constraints. By providing a framework to 'fix' environmental breakage or over-broad hooks, it enables the agent to alter the very mechanisms (PreToolUse hooks) that are intended to restrict its capabilities and prevent privilege escalation or destructive actions.
[DATA_EXFILTRATION]: The skill accesses highly sensitive agent files, including project transcripts in ~/.claude/projects and the main settings file ~/.claude/settings.json. While no network exfiltration is observed, this access constitutes high data exposure of the agent's private state and configuration.
[INDIRECT_PROMPT_INJECTION]: The automated triage process in scripts/replay-hook-blocks.py ingests data from past session transcripts. If an attacker can influence these transcripts by causing specific error patterns, they may be able to influence the automated rewriting of security hooks performed by the agent.

agent-infra-fixer