The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs users to store sensitive SMTP credentials, including CODEX_EMAIL_PASSWORD, in shell configuration files (~/.bashrc or ~/.zshrc). While utilizing environment variables is a common practice for secret management, storing them in plain-text shell profiles exposes them to any local process or user with read access to these files.
[INDIRECT_PROMPT_INJECTION]: The script scripts/send_email_notification.py reads content from a local AGENTS.md file to extract a project name, which is then interpolated into the email body sent to external recipients.
Ingestion points: Reads AGENTS.md in the current or parent directories via _find_agents_file and _get_project_name (scripts/send_email_notification.py).
Boundary markers: None. The extracted project name is directly placed into the body string.
Capability inventory: The script has network capabilities (smtplib) to send emails to external addresses.
Sanitization: None. The content is extracted via regex and used directly without validation or escaping.
Risk: An attacker who can influence the content of an AGENTS.md file (e.g., via a Pull Request or shared repository) could inject malicious instructions that the agent might follow if it processes the generated email, or use it to exfiltrate data via the email body.

email-notify