The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the local SQLite database for the Wispr Flow application located at ~/Library/Application Support/Wispr Flow/flow.sqlite. This file contains private dictation history, formatted text, and user dictionary data. Accessing this sensitive file path exposes personal user information to the agent's context as part of its primary function.
[COMMAND_EXECUTION]: The helper script scripts/wispr.py utilizes subprocess.run() to execute several system commands. Specifically, it calls ps to identify running processes, osascript to quit the Wispr Flow application, and open to relaunch the app after dictionary modifications. While these are used for application management, they provide an execution surface for system commands.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze transcription text which is untrusted user-generated content. This creates a surface for indirect prompt injection if the user's dictations contain phrases designed to manipulate LLM behavior.
Ingestion points: Data is read from the History table in the SQLite database via the history, terms, and snippets commands in scripts/wispr.py.
Boundary markers: The instructions do not define clear delimiters or use specific prompting techniques to isolate the untrusted transcription data from the agent's instructions.
Capability inventory: The agent has the ability to modify the dictionary database, write history to local files (via the --out argument), and control the lifecycle of the Wispr Flow process.
Sanitization: The script does not implement sanitization or filtering for the transcription text before it is presented to the agent.

wispr-flow-dictionary