The Agent Skills Directory

[COMMAND_EXECUTION]: The extraction scripts (extract-email-samples.js and extract-blog-samples.js) execute local helper scripts using child_process.spawn. These scripts run node or bun on dynamically constructed paths within the user's home directory (~/non-ic-code/geoffrey/skills/...), relying on the presence and integrity of sibling skill directories for Gmail and browser operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content for voice analysis, which creates a vulnerability to indirect prompt injection. If a fetched blog post or email contains malicious instructions designed for an LLM, the agent could potentially act on them during the analysis phase.
Ingestion points: External content is fetched from URLs via extract-blog-samples.js, from Gmail via extract-email-samples.js, and from social media platforms via extract-social-samples.js.
Boundary markers: Absent. There are no explicit instructions or delimiters used to warn the agent to ignore commands embedded within the writing samples.
Capability inventory: The skill is granted Bash, Read, and Write tools, which provides a high-impact capability set if an indirect injection were successful.
Sanitization: No security-focused sanitization is applied to the extracted text to remove potential prompt injection payloads before the content is analyzed by the LLM.

writer