The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from emails to generate AI summaries and reply drafts, creating an attack surface for indirect prompt injection.
Ingestion points: Untrusted content (email subjects and bodies) is fetched from external IMAP servers in scripts/email_client.py.
Boundary markers: There are no explicit delimiters or instructions provided to the AI to ignore instructions embedded within the email content.
Capability inventory: The skill includes capabilities to send emails (scripts/send_email.py) and write to local cache files (scripts/check_email.py).
Sanitization: No escaping or sanitization is performed on the email content before it is processed by the AI.
[COMMAND_EXECUTION]: The skill executes external shell commands to manage credentials.
Evidence: scripts/email_client.py uses subprocess.run(['pass', 'show', path], ...) to retrieve email passwords from the system's 'pass' utility. While this is a standard tool for secret management, it involves executing a binary on the host system.
[CREDENTIALS_UNSAFE]: A specific email address is hardcoded in the configuration.
Evidence: config/accounts.json contains the email address aaqwqaa68@gmail.com. This matches the author's identifier ('aaaaqwq') and likely serves as a default or test account, but hardcoding personal identifiers in shared skills is generally discouraged.

email-manager