The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/doctor.sh explicitly suggests and displays a command to download and execute a bootstrap script from GitHub: curl -fsSL https://raw.githubusercontent.com/${REPO}/main/bootstrap.sh | bash. This pattern is a classic remote code execution vector. While the URL points to the author's own repository (spiosifidis/my-claude-skills), executing unverified remote scripts poses a supply-chain risk.
[COMMAND_EXECUTION]: The skill makes extensive use of local shell commands to audit the system, including find, grep, ls, and osascript. It also suggests the use of npx to install or run remote packages (npx skills add ...).
[PRIVILEGE_ESCALATION]: The scripts/doctor.sh script suggests commands involving sudo to the user, specifically sudo chown -R "$(whoami)" "${d}", to resolve permission issues on specific directories. While these are presented as fix suggestions rather than auto-executed, they encourage the user to grant elevated privileges.

claude-doctor