The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses an 'Auto-Fix Protocol' to modify or recreate SKILL.md and config.json files based on content extracted from the library. This involves programmatically constructing markdown sections (e.g., <objective>, <quick_start>) and JSON configuration keys. If the skill processes a maliciously crafted input, it could unknowingly propagate or generate dangerous instructions into other skills. This mechanism of writing instruction-bearing files based on external input is a form of dynamic generation.
[DATA_EXFILTRATION]: The skill is designed to write telemetry and status data to a specific file: ~/.claude/skill-analytics/last-outcome-heal.json. While intended for success tracking, any operation writing to hidden configuration directories in the user's home folder is a sensitive file operation that could potentially be used to store persistent state or collect metadata about the user's environment outside the project workspace.
[INDIRECT_PROMPT_INJECTION]: The skill actively scans and parses content from other files in the library to perform its health checks. This creates a surface for indirect prompt injection.
Ingestion points: SKILL.md files (specifically frontmatter and body sections) and config.json files across the local skill library.
Boundary markers: Absent. The diagnostic engine does not appear to treat the content of audited skills as untrusted or escaped data when generating its internal state or health reports.
Capability inventory: The skill has significant capabilities including reading diverse file paths, overwriting/modifying skill instructions, and writing to the user's configuration directory.
Sanitization: The skill performs some functional sanitization (slugification, stripping XML tags) during the fix process, but these are for structural integrity rather than security filtering of natural language instructions.

heal-skill