skill-doctor
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts and standard git commands to identify project roots and process conversation data. These operations are essential to the tool's function and limited to the user's local environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted conversation history, which creates a potential surface for indirect instructions. (1) Ingestion points: Ingests JSONL transcripts from local agent harness directories (e.g., ~/.claude/projects/). (2) Boundary markers: Uses scoring rubrics for context but lacks specific adversarial isolation for the raw transcript content. (3) Capability inventory: Capabilities include local file writing to temporary directories and browser-based report viewing. (4) Sanitization: The collect_sessions.py script includes a looks_injected function to identify and strip common system-prompt injection tags.
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses ! shell command syntax in SKILL.md to establish temporary directories and verify repository state, which is a benign and documented use of the platform's dynamic features.
Audit Metadata