The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external source (Gmail inbox), which may contain malicious instructions intended to manipulate the agent's behavior.
Ingestion points: The get_message, list_messages, and get_thread actions in SKILL.md ingest email content into the agent's context.
Boundary markers: The skill does not define specific delimiters or warnings to separate external email content from the agent's instructions.
Capability inventory: The tool possesses extensive capabilities to act on data, including send_message, reply_message, forward_message, trash_message, and modify_labels as described in SKILL.md.
Sanitization: There is no mention of sanitization, filtering, or escaping of the email body content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill allows the agent to trigger downloads from external sources via the attachments feature.
Evidence: The attachments parameter in actions such as send_message, reply_message, and create_draft (found in schema.md) takes a file_url, which the remote tool fetches to attach files to emails.

gmail-all-email-actions