The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display untrusted data in the form of messages sent from other project directories or sessions. This creates a surface for indirect prompt injection if a message contains instructions intended to influence the agent's behavior.
Ingestion points: Messages are read from the global SQLite database ~/.claude/pmail.db via the read and read_one commands in scripts/mail-db.sh.
Boundary markers: The skill uses basic headers and separators (e.g., id | from_project | subject | body | timestamp) but lacks explicit instruction to the agent to ignore any commands or directives contained within the message bodies themselves.
Capability inventory: The skill has the ability to execute arbitrary bash commands (via the bash "$MAIL" pattern), read files (via the Read tool and attachment handling), and perform network operations if the agent is prompted to do so by a message.
Sanitization: While the scripts correctly use sed "s/'/''/g" to escape single quotes for SQLite safety (preventing SQL injection), they do not sanitize the message content for LLM instructions.
[COMMAND_EXECUTION]: The skill relies on executing local Bash scripts (mail-db.sh, identicon.sh, check-mail.sh) to perform its functions. While these scripts are part of the skill's own package, the pattern of routing user input through a shell script involves typical command execution risks.
Evidence: The SKILL.md file defines a router that maps user input directly to bash "$MAIL" <cmd> <args> calls. The scripts use set -euo pipefail and quote variables (e.g., "$safe_body") to mitigate standard shell injection risks.

pigeon