The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's documentation in reference/latency-optimization.md provides implementation patterns for recording conversation content (content) and performance metrics to an external Supabase database. This creates a data exfiltration path where potentially sensitive spoken interactions are transmitted to a third-party service.
[PERSISTENCE]: The SKILL.md file contains instructions for the agent to write outcome analytics to ~/.claude/skill-analytics/last-outcome-voice-ai-skill.json. This is a persistent file write operation targeting the user's home directory, which remains outside the immediate project workspace.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted audio data via Deepgram transcription, which is then converted to text and interpolated into LLM prompts in reference/groq-voice-llm.md and templates/voice-agent-starter.py.
Ingestion points: Transcribed user_text is passed into the conversation history and subsequent LLM calls.
Boundary markers: While reference/voice-prompts.md suggests using tags like --- USER CONTEXT ---, the core implementation in templates/voice-agent-starter.py simply appends messages to a list, lacking robust boundary enforcement.
Capability inventory: The agent has extensive network capabilities (Groq, Deepgram, Cartesia, Twilio, Supabase) and file system access (writing analytics).
Sanitization: No explicit sanitization or filtering of transcribed text is performed before it is used to influence the agent's behavior in the next turn.

voice-ai-skill