The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external emails and attachments, which serves as a potential surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the context through get_thread, list_messages, search_messages, and get_attachment tools (SKILL.md, references/email-tools.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the email content parsing.
Capability inventory: The skill possesses significant external and destructive capabilities, including send_message, reply_to_message, forward_message, and delete_thread (references/email-tools.md).
Sanitization: No specific data sanitization or filtering logic is mentioned for processed email bodies.
Mitigation: The risk is effectively managed by strict procedural constraints requiring the agent to restate message details and obtain explicit user confirmation before any send or delete operation (SKILL.md).

agentmailer-email