The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted incoming email content from various providers to generate summaries, research senders, and draft replies. This creates a surface for indirect prompt injection, where malicious instructions hidden in an email could attempt to manipulate the agent's behavior.
Ingestion points: Incoming email thread content and snippets are ingested in Step 2 and Step 3 via email provider tools.
Boundary markers: The instructions do not specify the use of clear delimiters or 'ignore' directives to isolate external email text from the system prompt.
Capability inventory: The skill has permissions to read and write to the ${WORKSPACE}/Email/ directory, perform web searches, and create email drafts.
Sanitization: No specific sanitization process is described for the email content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill relies on local Python scripts (scripts/kb_reader.py, scripts/search_window_calculator.py, and scripts/draft_safety_validator.py) to handle its core logic, file parsing, and safety enforcement. These scripts are executed as part of the triage process.

inbox-triage