The Agent Skills Directory

[COMMAND_EXECUTION]: The skill workflow instructs the agent to execute a shell command with user-supplied content by directly interpolating the email subject into a command string: python scripts/score_subject_line.py --subject "[subject]". If an email subject line contains shell metacharacters like semicolons, backticks, or command substitutions, this can lead to arbitrary command execution on the host platform.
[INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted external data which can contain hidden instructions or malicious payloads designed to manipulate the agent or underlying system.
Ingestion points: Ingests untrusted third-party email data (subject line, body copy, raw HTML, file paths, and Gmail drafts) in SKILL.md.
Boundary markers: Absent. There are no delimiters or explicit instructions to prevent the model from following commands embedded inside the email content.
Capability inventory: Uses the Bash tool to run local scripts (scripts/score_subject_line.py and scripts/analyze_email_html.py) and interacts with Gmail via MCP tools (gmail_get_draft, gmail_send_message).
Sanitization: Absent. No filtering, validation, or shell escaping mechanisms are defined before data interpolation or text analysis.

email-review