The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the osascript utility to execute AppleScript code blocks directly from the shell. These commands interact with the system's Mail application to perform actions like listing accounts, reading messages, and sending emails.
[DATA_EXFILTRATION]: The skill provides capabilities to read highly sensitive information, including account names, email subjects, sender details, and full body content (content of msg). While this is the intended functionality, it creates a risk of data exposure if the agent is directed to process or summarize sensitive communications without proper constraints.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant surface for indirect prompt injection.
Ingestion points: Data is ingested from external email subjects and bodies via AppleScript (SKILL.md).
Boundary markers: The instructions lack any boundary markers or instructions to the agent to ignore potentially malicious commands embedded within the emails it reads.
Capability inventory: The skill possesses the ability to read, send, reply to, and delete emails across all scripts.
Sanitization: There is no evidence of sanitization or filtering for the external content retrieved from the Mail app.
[DYNAMIC_EXECUTION]: The skill uses heredoc syntax (osascript <<'EOF') to generate and execute AppleScript code at runtime. While these are based on static templates within the skill, the dynamic nature of the execution via shell subprocesses is a technique often used to bypass static analysis.

apple-mail