The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documents the use of the hey auth token command, which allows the agent to retrieve and potentially expose the HEY account's sensitive bearer token.
[PRIVILEGE_ESCALATION]: The instructions direct the agent to request 'elevated sandbox permission' on macOS if an authentication error is encountered, which is an explicit attempt to bypass standard security and isolation constraints.
[COMMAND_EXECUTION]: The hey watch command includes support for --run-sync and --run-async flags that execute local scripts (such as ./triage.sh) in response to incoming email events, enabling automated command execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from email boxes and threads and possesses sensitive capabilities to act on that data.
Ingestion points: Email threads, messages, and journal entries via hey box view, hey search, hey thread read, and hey journal read.
Boundary markers: Absent; there are no instructions to use delimiters or ignore embedded commands in the processed text.
Capability inventory: The skill can send emails (hey compose, hey reply), delete data (hey trash, hey delete), and access authentication tokens (hey auth token).
Sanitization: No specific prompt-level sanitization or escaping of untrusted content is implemented.

hey