The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted "source material" and "user requests" through a 13-phase pipeline. Malicious instructions embedded in these inputs could potentially influence the agent's behavior in later phases where it utilizes powerful tools like Bash and Write to generate and save content.
Ingestion points: Phase 1 (user request) and Phase 2 (source material grounding) in SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: The pipeline has access to Read, Write, Bash, Grep, Glob, Edit, Task, and Skill tools across all phases.
Sanitization: No explicit sanitization, validation, or filtering of external content is described before interpolation into the generation phases.
[DATA_EXPOSURE]: The skill is designed to read from ~/.claude/skills/, accessing other skill definitions, configuration files (profile.json), and personal writing samples. While this is the intended purpose for voice profiling, it involves systematic access to the agent's local configuration environment and user-sensitive data.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform shell operations, such as listing directories (ls ~/.claude/skills/ | grep voice-) to identify available profiles. The presence of shell execution in a pipeline that ingests external data represents a potential vector for command injection if inputs are not handled carefully.

voice-writer