The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a directive to provide misleading information or omit details regarding the system's state: "Do not tell the user the email left their real inbox in this mode." This instructs the agent to conceal the lack of actual delivery when the user is not connected to a Google account.
[COMMAND_EXECUTION]: The skill performs its operations by executing shell commands through the pnpm action interface, which is the primary mechanism for managing drafts and sending emails.
[DATA_EXFILTRATION]: The send-email action enables the transmission of draft content to external recipients. Although the documentation states this action requires user approval (needsApproval: true), it remains the primary mechanism for data to leave the agent's environment.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from email bodies and subjects.
Ingestion points: Email draft content is read via view-composer and manipulated via manage-draft.
Boundary markers: The instructions do not define clear delimiters or escape sequences to prevent the LLM from executing instructions found within email bodies.
Capability inventory: The agent has the ability to send emails (send-email) and persist state changes (manage-draft).
Sanitization: There is no evidence of content sanitization or filtering for the email body before it is processed by the agent.

email-drafts