The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill reads settings.local.json and environment variables to audit the configuration. These files often contain sensitive user configuration or personal settings. The risk of exposure is restricted to the local agent context as the skill has no network tools (curl, wget, fetch) permitted in its configuration.
[COMMAND_EXECUTION]: The skill is configured with Bash(rm:*) capabilities to facilitate the removal of junk files, such as .DS_Store, .zip archives, and temporary files (.tmp*), specifically within the .claude/ directory. This behavior is intended for directory hygiene and is triggered by specific fix flags.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and parses the content of external Markdown files to extract command names and verify naming consistency and override policies. This represents a potential surface for indirect injection if the processed files contain malicious instructions.
Ingestion points: Processes .claude/rules/*.md and .claude/skills/*/SKILL.md from the local file system.
Boundary markers: No explicit delimiters or boundary markers are used when reading these files.
Capability inventory: The skill possesses Read, Grep, Glob, and Bash capabilities, which are used to evaluate the ingested content.
Sanitization: There is no evidence of sanitization or escaping applied to the content extracted from rules or skills before it is used in the health check logic.

claude-health