The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external email sources through commands like mail_read, mail_list, and mail_search. This creates a vulnerability surface where malicious instructions embedded in incoming emails could attempt to influence the agent's behavior.
Ingestion points: Email bodies and metadata are read into the agent's context in SKILL.md and scripts/mail-ops.sh.
Boundary markers: The skill includes explicit defensive instructions in the 安全规则 (Security Rules) section of SKILL.md and references/agently-cli-guide.md, warning the agent to treat email content as data only and to ignore any embedded instructions.
Capability inventory: The skill has significant capabilities including sending emails (mail_send), replying/forwarding, and downloading attachments to the local filesystem (mail_download).
Sanitization: The skill relies on LLM-level instruction following rather than programmatic sanitization of the email content.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes official CLI tools from well-known service providers via NPM. In scripts/mail-ops.sh, it uses npx --yes "@clawemail/mail-cli@latest" to fetch the NetEase tool, and SKILL.md instructs the user to install @tencent-qqmail/agently-cli globally. Additionally, claw_init in mail-ops.sh fetches authentication metadata from a NetEase shortlink (u.163.com).
[COMMAND_EXECUTION]: The skill performs shell command execution to interface with email backends. It uses npx for NetEase and a global binary for Tencent. Notably, _agently_login in scripts/mail-ops.sh uses the script utility to spawn a background process and capture OAuth URLs from an interactive TTY session.
[DATA_EXFILTRATION]: The skill provides the ability to read local files via the --body-file parameter in the mail_send function (implemented in scripts/mail-ops.sh). This allows the agent to read local data (like logs or reports) and transmit them to external email servers. While this is the intended function, it is a sensitive capability in an AI agent context.

agent-email