context-doctor
Warn
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses sensitive transcript files. The instructions direct the agent to scan
~/.claude/projects/**/<uuid>.jsonl, which contains full histories of past user-AI interactions. This constitutes exposure of private communication data stored on the local filesystem. - [PROMPT_INJECTION]: Indirect injection surface via historical data. By processing
~/.claude/projects/JSONL files, the agent ingests untrusted data from past sessions. The skill lacks explicit boundary markers or sanitization for this ingested data, meaning malicious content in previous prompts could be re-processed and executed during the audit. - [PROMPT_INJECTION]: System prompt analysis. The skill instructs the agent to inspect its own system prompt and tool definitions ("Read what you were actually given this session"), which is a technique used to reveal internal agent configurations and instructions intended for the model harness rather than the user.
- [COMMAND_EXECUTION]: Modifications to persistent configuration files. The skill directs the agent to propose and apply changes to project-level and global files such as
CLAUDE.md,AGENTS.md, and internal agent settings. Modifying these files can permanently alter the agent's behavior and security constraints across different projects and sessions.
Audit Metadata