The Agent Skills Directory

Dynamic Script Generation: The skill is designed to guide the agent in writing TypeScript files to the agent/custom_scripts/actions/ directory, which are subsequently loaded and executed by the platform. This capability allows for the creation of new, executable logic at runtime, which is a pattern that should be monitored to ensure only authorized scripts are created.
Indirect Prompt Injection Surface: Several templates, such as the bug report forwarder, are designed to process untrusted data from incoming emails using an internal AI call (context.callAgent). This creates a surface where specifically crafted email content could potentially influence the behavior of the generated action.
Ingestion points: The email.body and email.subject fields are retrieved and processed in the templates/forward-bug-report.ts handler.
Boundary markers: The templates do not currently implement specific delimiters or instructions to ignore embedded commands within the email data.
Capability inventory: The execution environment provides access to sensitive functions including sendEmail, emailAPI, and external network requests via fetch.
Sanitization: There is no evidence of content sanitization or validation performed on the email data before it is passed to the AI agent or used in email composition.
Sensitive Capability Access: The ActionContext provides the generated scripts with significant permissions, including the ability to search all emails, send new messages, and reach external URLs. These capabilities are powerful tools for automation but also increase the impact if a generated script were to be misused.

action-creator