The Agent Skills Directory

[PERSISTENCE]: The install_host.py script modifies the host environment configuration (~/.claude/settings.json) to install persistent hooks. These hooks (SessionStart, PostToolUse) execute a Python runner (claude_hook.py) on specific application events. While the script implements a sidecar for uninstallation and requires user confirmation, this establishes persistence within the host environment.
[COMMAND_EXECUTION]: Multiple scripts, including install_host.py and test helpers, execute shell commands via subprocess.run to manage the installation, run scripts, and conduct tests. The installer script also performs significant filesystem operations, such as creating directory structures, replacing configuration files, and managing backups in the user's home directory.
[DYNAMIC_EXECUTION]: The scripts/_bootstrap.py file dynamically modifies the Python sys.path to locate and import the rwlib library from sibling directories. Additionally, tests/run.py uses the __import__ function to dynamically load and execute test modules.
[PROMPT_INJECTION]: The SKILL.md instructions define a specific 'Taste Interviewer' persona for the agent. This roleplay is intended to extract writing style DNA from the user through structured questioning and pushes the agent to adopt a firm, truth-seeking posture.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted writing samples provided by the user. It contains an attack surface for indirect prompt injection (e.g., instructions hidden in markdown comments). However, the skill implements a mandatory 'P0 contamination gate' in measure_voice.py and audit_voice.py which explicitly scans for and blocks execution if common AI directive overrides or hidden unicode artifacts are detected.
Ingestion points: Writing samples loaded from the local filesystem by measure_voice.py, audit_voice.py, and learn_edits.py.
Boundary markers: The skill relies on specific regex-based detection of 'P0' fingerprints (e.g., 'ignore all previous instructions') to identify malicious content.
Capability inventory: The skill can read/write local files and install persistent hooks in the host application configuration.
Sanitization: The P0 gate serves as a primary sanitization layer, exiting with an error if suspicious patterns are identified in the processed data.

voice-setup