The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The script scripts/send_email.py allows providing an SMTP password or authorization code as a command-line argument (--pass). Sensitive credentials passed via command-line arguments are visible in the system's process list to all users, creating a risk of unauthorized access. The script does include a secure interactive fallback using getpass.getpass(), which is the recommended practice.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted user-provided content, creating an attack surface where embedded instructions could target the agent.
Ingestion points: The subject and body command-line arguments in scripts/send_email.py receive external data.
Boundary markers: Absent. The data is interpolated directly into MIMEText objects without delimiters or instructions to ignore embedded commands.
Capability inventory: scripts/send_email.py utilizes the smtplib library to perform network operations and transmit data to external SMTP servers.
Sanitization: Absent. The script does not validate, filter, or escape the content of the email subject or body.

smtp-email-sender