The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documents the hey auth token command, which prints a live bearer token to the terminal. An agent could be manipulated into executing this command and disclosing the secret token to an unauthorized party.
[COMMAND_EXECUTION]: The hey watch command supports --run-sync and --run-async flags, which allow the agent to execute arbitrary local shell scripts (e.g., ./triage.sh) whenever email or calendar events occur.
[PRIVILEGE_ESCALATION]: In the Authentication section of SKILL.md, the agent is instructed to request 'elevated sandbox permission' if it cannot access credentials. This is an explicit instruction to bypass standard security boundaries or platform-level isolation.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources that could contain malicious instructions designed to manipulate the agent.
Ingestion points: Data is ingested through hey thread read (email bodies), hey contact note show (contact notes), and hey journal read (journal entries).
Boundary markers: The instructions mention that content is converted to Markdown, but there are no explicit delimiters or system instructions defined to prevent the agent from following commands embedded within the emails.
Capability inventory: The agent has the ability to send emails (hey compose), delete records (hey trash, hey todo delete), and save files (hey attachment save).
Sanitization: No filtering or sanitization of prompt injection patterns is described for the content read from HEY.
[DYNAMIC_EXECUTION]: The skill enables dynamic execution of logic via the hey watch command's ability to trigger external scripts based on real-time event data received from the HEY websocket service.

hey