The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from the AgentID marketplace and external emails.
Ingestion points: External content enters the context via list_apps, get_app (third-party app descriptions/metadata), and agentmail-check-email (incoming messages from external services).
Boundary markers: The skill provides explicit instructions to treat external names and descriptions as data rather than instructions. It also defines an authorization matrix that requires direct user consent for actions like account connection.
Capability inventory: The skill has the ability to link accounts (connect_app), navigate to authentication URLs, and instructions to write sensitive data to .env files.
Sanitization: The skill mandates that secrets must not be repeated in chat or emails and should be stored securely in secret stores or gitignored environment files.

agentmail-agentid