The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The generate_reply function in scripts/instantly_autoreply.py interpolates the incoming_email content directly from an external webhook into the prompt for the Claude LLM. This creates a significant surface for indirect prompt injection, as an external sender could embed instructions to override the agent's behavior, bypass rules, or extract internal context.
Evidence Chain:
Ingestion points: payload.get("reply_text") in scripts/instantly_autoreply.py.
Boundary markers: Absent; the prompt uses simple string concatenation for untrusted data.
Capability inventory: The skill has the capability to send emails via the Instantly API (send_reply) and read data from Google Sheets.
Sanitization: No sanitization or filtering is performed on the incoming email text before prompt interpolation.
[DATA_EXPOSURE]: The script in scripts/instantly_autoreply.py contains a local testing block that attempts to read ../token.json. Accessing credential files in a parent directory is a risky pattern that could lead to the exposure of sensitive OAuth tokens if the environment is not properly isolated.
[DATA_EXPOSURE]: The SKILL.md file documentation explicitly states that the knowledge base spreadsheet contains "credentials" (service details, offers, credentials). Retrieving these credentials and passing them as raw text context to an LLM to generate public-facing email replies is a dangerous practice that increases the risk of credential leakage.
[COMMAND_EXECUTION]: The skill requires the execution of a Python script (instantly_autoreply.py) which performs network operations (Requests to Instantly and Google APIs) and local file system access.

instantly-autoreply