The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes external email data.
Ingestion points: The skill reads email bodies, subjects, and sender information via context.emailAPI (e.g., in templates/forward-bug-report.ts).
Boundary markers: The templates do not use delimiters or instructions to ignore embedded commands when passing email content to context.callAgent.
Capability inventory: The generated scripts have access to powerful capabilities including sendEmail, archiveEmail, fetch for network requests, and callAgent for further AI processing.
Sanitization: No evidence of filtering, escaping, or validation of the ingested email content is present in the provided templates.
[COMMAND_EXECUTION]: The primary purpose of the skill is to generate TypeScript files in agent/custom_scripts/actions/ which are executed by the agent platform. This dynamic code generation and execution is a high-privilege activity.
[DATA_EXFILTRATION]: The ActionContext documented in SKILL.md provides a fetch method, allowing generated scripts to make network requests to external domains. This capability could be used to transmit data retrieved from emails to external servers.

action-creator