The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as its core function involves processing and responding to untrusted external data such as email threads, Slack messages, and LinkedIn DMs.
Ingestion points: Message content pasted by the user or retrieved from the active conversation context.
Boundary markers: The skill does not define explicit delimiters for untrusted content within its instructions, though it relies on a structured workflow to classify and filter the input.
Capability inventory: Drafting and outputting text. Integration with external tools (like Gmail via MCP) is pull-based and requires explicit user consent for each action.
Sanitization: Implements a 'leak guard' scan that checks the finalized draft for conversation-internal details or 'AI drafting' markers before displaying the result to the user.
[DATA_EXFILTRATION]: The skill accesses personal files in the user's home directory (~/.claude/ghostwriter/) and reads platform-specific profile information (~/.claude/CLAUDE.md). This access is scoped to the skill's stated purpose of maintaining a persistent, local voice profile. There are no patterns suggesting the exfiltration of this data to remote servers; all data processing and storage are described as remaining on the user's local machine.

ghostwriter