heal-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from other skill files within the agent's environment, which could contain malicious instructions designed to influence the healing process or exploit the diagnostic engine.
- Ingestion points: The engine reads and parses YAML frontmatter, XML sections, and config.json structures from all skills in the scanned directories (SKILL.md, config.json).
- Boundary markers: No explicit instruction delimiters or 'ignore embedded instructions' warnings are present to isolate data from instructions during parsing.
- Capability inventory: The skill possesses extensive file-reading capabilities for diagnostics and file-writing capabilities for auto-repairing identified issues and logging telemetry to
~/.claude/skill-analytics/last-outcome-heal.json. - Sanitization: The skill employs standard YAML and JSON parsers and implements specific regex-based cleaning (e.g., check S6) to strip XML tags from descriptions, which serves as a mitigation against certain injection techniques that target the slash command parser.
Audit Metadata