The Agent Skills Directory

[COMMAND_EXECUTION]: A code example for processing email attachments contains a path traversal vulnerability.
Evidence: In references/handler-examples.md, the processAttachments function constructs a file path using path.join('/tmp/attachments', attachment.Name) and writes to it using fs.writeFileSync.
Risk: Because attachment.Name is derived directly from the untrusted webhook payload without sanitization, a malicious sender could provide a filename containing directory traversal sequences (e.g., ../../etc/shadow) to attempt to overwrite or create files in unauthorized directories.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from emails, which are untrusted external sources, creating a surface for indirect prompt injection.
Ingestion points: The skill parses fields such as From, Subject, TextBody, HtmlBody, and StrippedTextReply from the JSON payload delivered to the webhook endpoint, as described in SKILL.md and references/payload-structure.md.
Boundary markers: The instructions and example handlers do not implement delimiters or safety instructions to prevent the agent or application from interpreting malicious commands embedded within the email text.
Capability inventory: The skill includes capabilities for file system writes (fs.writeFileSync), console logging, and network operations through the Postmark API (e.g., client.sendEmail, client.getInboundMessages).
Sanitization: The provided examples lack logic for sanitizing or validating email content or attachment metadata before it is processed or stored.

postmark-inbound