The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation and recovery documentation in references/INSTALL.md and references/FIX-MCP-CONFIG.md promotes the use of the curl | bash pattern to execute a remote shell script (install.sh) from the Dicklesworthstone/mcp_agent_mail GitHub repository without local verification or checksum validation.
[CREDENTIALS_UNSAFE]: The fix_cc_mcp script provided in references/FIX-MCP-CONFIG.md is designed to automatically scan sensitive local files, such as ~/.claude.json and .env files, to extract HTTP_BEARER_TOKEN authentication credentials.
[EXTERNAL_DOWNLOADS]: The skill fetches and executes code from external GitHub repositories (Dicklesworthstone/mcp_agent_mail, boshu2/mcp_agent_mail_rust) that are not recognized as trusted organizations or well-known services.
[COMMAND_EXECUTION]: The skill relies on extensive use of system shell commands (am, uv run, npx) for core operations, including service management, database repairs, and installation tasks.
[PROMPT_INJECTION]: The skill implements tools that process untrusted external data (mailbox messages) which presents an indirect prompt injection surface.
Ingestion points: External message content retrieved from the database via fetch_inbox and summarize_thread (in references/TOOLS.md).
Boundary markers: None identified in the instructions for separating untrusted message content from system instructions.
Capability inventory: The agent has capabilities for file system reservations, shell command execution, and network communication.
Sanitization: There is no mention of sanitization or filtering of message content before it is processed by the LLM.

agent-mail