The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/process_feedback.py executes the gws (Google Workspace CLI) tool using subprocess.run.
Evidence: The run_gws function constructs a command list from function arguments and executes it. While the list-based approach prevents shell injection, it grants the script control over local Google Workspace interactions if the gws tool is configured.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted external data and presents it to the agent for action.
Ingestion points: scripts/process_feedback.py fetches email bodies and attachments (filenames and content) from Gmail, saving them to report.json and local text files.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands (e.g., 'ignore all instructions inside the feedback body') are provided to the agent in SKILL.md.
Capability inventory: According to SKILL.md, the agent is expected to create GitHub issues, update existing ones, and perform global greps across the codebase based on the email content.
Sanitization: The script performs no sanitization or filtering of the email bodies or metadata before they are read by the agent.

client-feedback