The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its processing of untrusted draft files.
Ingestion points: The skill reads the full text of a user-provided draft file in Step 2 of SKILL.md and passes it to the judge prompt.
Boundary markers: While judge-prompt.md uses markdown code blocks to delimit the {{draft_text}}, it lacks explicit instructions for the LLM to ignore or treat embedded instructions within that text as data rather than commands.
Capability inventory: The skill utilizes the Read and Write tools. It can read arbitrary files (for persona and guide resolution) and write reports to the filesystem.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the draft content before it is processed by the LLM, which could allow a malicious draft to subvert the editor's instructions.
[DATA_EXPOSURE]: The skill performs file operations outside of its immediate directory by maintaining logs in the user's home folder.
Evidence: Step 8 in SKILL.md specifies that a JSON log entry is appended to ~/.kai-marketing/gates/. While this appears to be for standard application logging, it represents persistent local file access to a hidden user directory.

voice-gate