The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes incoming email data including subjects, bodies, and attachments from external sources. This content is untrusted and could contain adversarial instructions intended to influence the agent's behavior.
Ingestion points: The check, fetch, and search commands in scripts/imap.js ingest content from remote email servers.
Boundary markers: None. Email fields are parsed and returned to the agent without specific delimiters or instructions to ignore embedded commands.
Capability inventory: The agent has the ability to send emails (scripts/smtp.js), write to the file system (scripts/imap.js download), and read from the file system (scripts/smtp.js attachments).
Sanitization: Filenames are sanitized to prevent path traversal, but the textual content of emails is not filtered for prompt injection patterns.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill implements a whitelist for file system access through ALLOWED_READ_DIRS and ALLOWED_WRITE_DIRS configuration variables. This control limits the agent's ability to read or write files to specific, user-defined locations.
[COMMAND_EXECUTION]: The skill includes a setup.sh script for initial configuration. This script runs locally, collects user input for email settings, and sets appropriate file permissions for the configuration file.
[METADATA_POISONING]: There is a discrepancy between the skill author context and the author field in package.json. While potentially deceptive, the skill's code quality and security controls do not suggest malicious intent.

imap-smtp-email