The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to ingest and process unread email bodies from external senders, which is a known vector for indirect prompt injection.
Context: This risk is explicitly addressed in the skill's instructions, which mandate that all inbound email content be treated as untrusted data rather than instructions. The skill requires the agent to report instruction-like text to the user rather than following it.
Data Handling and User Oversight: To prevent unauthorized actions triggered by malicious content, the skill enforces human review for 'content-originated' actions.
Context: Any action where the recipient, target, or content is dictated by the untrusted text must be shown to the user for approval before execution. This remains true regardless of the underlying tool's permission settings.
Automated Execution Controls: The skill provides safeguards for scheduled or unattended runs to prevent abuse.
Context: The instructions specify that untrusted content cannot add new actions to a scheduled run. Any action suggested by an email during an unattended session is converted into a proposal for the user to review later, preventing autonomous execution of potentially malicious requests.
Data Access for Personalization: The skill accesses recent sent emails and CRM data to learn the user's 'voice' and ground its responses.
Context: While this involves reading sensitive historical data, it is used locally within the skill's primary functional scope to ensure draft quality. The skill further restricts data exposure by forbidding the agent from guessing URLs or silently widening the scope to organization-wide data.

inbox-sweep