The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides tools like install_precommit_guard which modifies the git repository's configuration by installing a pre-commit hook. This creates a persistence mechanism where the guard code is executed automatically during git operations.
[COMMAND_EXECUTION]: The am clear-and-reset-everything command allows for the irreversible deletion of the skill's database and all stored messaging records. This represents a significant destructive capability if misused.
[CREDENTIALS_UNSAFE]: Documentation for the am share decrypt command in references/RECOVERY.md references the sensitive file path ~/.age/key.txt, which is a common location for private encryption keys. An agent following these instructions might attempt to access or expose these credentials.
[REMOTE_CODE_EXECUTION]: The am doctor restore functionality allows the skill's state to be restored from an external ZIP archive. This could be used to inject malicious database content or state into the agent's environment from an untrusted source.
[COMMAND_EXECUTION]: The skill makes extensive use of the am CLI tool to manage project paths, messaging, and file reservations. The am share export tool includes complex data processing features like cryptographic signing and content scrubbing, which increase the attack surface for processing mailbox data.
[PROMPT_INJECTION]: The skill processes potentially untrusted content via fetch_inbox and search_messages, which ingest Markdown bodies. This provides an attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through the message bodies in fetch_inbox and search_messages (referenced in references/TOOLS.md).
Boundary markers: There are no explicit delimiters or warnings to ignore embedded instructions within the message bodies.
Capability inventory: The skill possesses capabilities for git hook installation (install_precommit_guard), destructive resets (am clear-and-reset-everything), and state restoration (am doctor restore).
Sanitization: No sanitization, validation, or filtering of external message content is documented.

agent-mail