The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface as it processes session transcripts, repository files, and user-controlled configuration files which could contain malicious instructions.
Ingestion points: Accesses session transcripts (~/.claude/projects/*.jsonl), local and project settings files, and repository documentation (CLAUDE.md).
Boundary markers: The instructions explicitly label these sources as untrusted data and strictly forbid following any instructions found within them. It uses jq with argument passing (--arg) to separate data from logic.
Capability inventory: The skill can read/write local configuration files, execute shell commands (Bash), and perform network lookups.
Sanitization: Implements mandatory use of jq for JSON manipulation, requires temporary files for file merges to prevent race conditions, and forbids string interpolation of harvested values into shell commands.
[COMMAND_EXECUTION]: The skill executes multiple CLI tools to diagnose environment health and check installation status.
Evidence: Uses tools like jq, git, npm, and claude throughout its diagnostic checks (Check 0, 5, 7, and 9).
Mitigation: The skill includes a 'never-inline' ground rule to prevent command injection, ensuring that any data harvested from the environment is treated as untrusted and passed as quoted arguments.
[EXTERNAL_DOWNLOADS]: The skill connects to remote services to verify if the local installation is up to date.
Evidence: Fetches version information from the NPM registry, downloads.claude.ai, and the Homebrew API (formulae.brew.sh).
Context: These connections target well-known, official service endpoints for the sole purpose of version verification and are disabled if the user has opted into essential-traffic mode.

doctor