The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes untrusted content from incoming email threads.\n
Ingestion points: Incoming email threads are retrieved using Gmail or Outlook MCP tools as described in Step 2 of the SKILL.md file.\n
Boundary markers: The instructions do not define explicit delimiters or instructions to ignore potential commands embedded within email bodies during processing.\n
Capability inventory: The agent has permissions to write to multiple files within the local workspace (blocklist.md, tracker.md, triage-log/) and can perform external web searches (Step 4).\n
Sanitization: There is no evidence of sanitization or escaping of email content before it is processed for classification or used to generate draft recommendations.\n- [COMMAND_EXECUTION]: The skill invokes specific Python scripts included in the package to perform core logic and security validation operations.\n
scripts/kb_reader.py is executed to validate the existence and format of the 7-file knowledge base required for operation.\n
scripts/search_window_calculator.py performs datetime arithmetic to compute the appropriate search window for the current run.\n
scripts/draft_safety_validator.py provides a critical post-run security check to ensure the 'never-send' policy was respected by scanning logs for send-related tool calls.\n- [DATA_EXFILTRATION]: The skill performs external web searches in Step 4 to research new senders. This involves transmitting sender-related metadata, such as names and domains, to third-party search providers.

inbox-triage