What's in a Persona File, and What Never Leaves Your Drive

Your persona plugin contains none of your files. Not one PDF, not one calendar event, not one call transcript. That's the whole design, and it deserves a precise explanation, because "connect your Google Drive and we'll build a plugin from it" sounds like the setup for a data horror story.

The boundary, stated plainly: the synthesis step reads your corpus, and the plugin ships only what the synthesis wrote. Two artifacts, two lifecycles, and a path-whitelist between them.

What's actually in the plugin

A persona plugin is an ordinary Claude Code plugin. Here's the shape of the demo one:

lautaro/
├── .claude-plugin/
│   └── plugin.json
└── skills/
    └── lautaro/
        ├── SKILL.md
        └── references/
            ├── voice.md
            ├── frameworks.md
            └── track-record.md

SKILL.md is Markdown with YAML frontmatter: a name and a description that tells Claude Code when to load the persona ("when the user asks what Lautaro would say", roughly). The body is distilled operating knowledge: how the person evaluates a pitch, what they'd cut from a landing page, the cadence of their sentences. The references/ directory holds longer docs the skill pulls in on demand, so the base context stays small.

Note what that content is. Not "here are 400 Drive documents." It's claims and heuristics: sold Sirena to Zenvia for $30M, believes distribution beats product in LatAm B2B, writes short declarative paragraphs and hates hedging. Facts about a person, extracted from documents. The documents themselves are gone by the time the plugin exists.

Every file is plain text. There is no binary blob, no encrypted payload, no minified anything. You can read the entire plugin in one sitting, and you should.

What the synthesis reads, and where

The synthesis step is the only step that touches your raw corpus: Drive files, calendar, call transcripts. It runs in the creator's own session, with the creator's own connector scopes. It reads a lot and writes a little. Gigabytes of source become a few thousand words of distilled prose.

That compression is the privacy mechanism as much as the intelligence mechanism. A skill that quoted your documents at length would be a worse skill (bloated context, brittle voice) and a worse leak. The output is a model of you, not an archive of you.

The packager whitelist

Between "synthesized files on disk" and "installable plugin" sits a packager with a hard path-whitelist. Only .claude-plugin/, skills/, and commands/ (when a persona ships commands) are committed to the marketplace repo. Staging notes, raw exports, sync caches, anything the synthesis produced along the way: not on the list, never enters git.

This matters because of how Claude Code plugin distribution actually works. /plugin marketplace add https://installs.me/lautaro fetches a marketplace.json. Each plugin entry in it points at a git-backed source (git-subdir; plugin sources served over a URL must be git-backed, relative HTTP paths silently fail). What an installer receives is exactly the contents of that git subtree, verified against Claude Code CLI 2.1.x behavior.

The consequence is stronger than a policy promise: there is no runtime channel. The installed plugin makes no callback to installs.me, ships no MCP server that could phone home, and never touches your Drive at install time or after. It's static text. If a byte isn't in the git history, no installer can obtain it.

It also hands you the audit method. Clone the marketplace repo. grep -r for anything you're worried about. git log shows every version ever published, including what was in v1 before you tightened it in v2.

The review gate

A path-whitelist catches files. It cannot catch semantics. Compression can still leak: a voice guide might reproduce a sentence from a private memo verbatim, a frameworks doc might name a company you advise under NDA.

So there's a human gate. Before anything publishes, the creator reads the synthesized skill, all of it. It's a handful of prose files, ten minutes of reading. Delete a line and it's gone from the plugin while remaining in your Drive, untouched. Nothing goes into the marketplace repo without that pass.

The rule of thumb: treat your SKILL.md like a blog post with your name on it, because functionally that's what it is. If you wouldn't publish the sentence, cut it at review.

What never leaves

Your raw corpus never enters the plugin, never enters the marketplace repo, and is never fetched by anyone who installs you. The Drive and Calendar connections are read scopes used during synthesis; revoke them the day after you publish and the plugin keeps working forever, because it never referenced them.

The asymmetry is the product. The source stays private and messy, the way real archives are. The output is public, small, and legible, the way published work should be. One direction only: your files shape the persona, the persona never exposes your files.

And because the whole artifact is text you can read before running anything, "trust us" isn't the ask. "Read the diff" is.

Install a person

installs.me turns your files, calendar and calls into a Claude Code plugin that thinks like you. Anyone installs it with two commands:

/plugin marketplace add https://installs.me/lautaro
/plugin install lautaro@lautaro-installs