The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes inbound emails to automate scheduling, which introduces a surface for indirect prompt injection where malicious instructions could be embedded in message bodies.
Ingestion points: Untrusted data enters the agent context through get_email, get_thread, and list_emails tools as defined in references/tools.md.
Boundary markers: The skill contains explicit instructions in references/security.md and SKILL.md to treat all inbound content as untrusted data and to ignore any embedded instructions that attempt to override agent behavior.
Capability inventory: The skill has the ability to write to Google Calendar (event creation) and send emails (send/reply/schedule) as described in references/tools.md and references/workflows.md.
Sanitization: Multiple layers of protection are implemented, including a 10,000 character truncation limit per message, a requirement for scan_status: clean before body interpretation, and mandatory human-in-the-loop preview and approval for every external-effect operation.

mermail-scheduling-agent