The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from incoming support emails, creating a surface for potential indirect prompt injection attacks.\n
Ingestion points: The agent ingests untrusted data from email subjects, bodies, and headers via tools like list_emails, search_emails, and get_thread as described in SKILL.md and references/workflows.md.\n
Boundary markers: While the instructions explicitly state to treat inbound content as untrusted data rather than instructions, the prompt templates do not specify formal delimiters to separate email content from the system instructions.\n
Capability inventory: The agent has access to tools with external side effects, including reply_to_email, forward_email, and delete_email (mapped in references/tools.md).\n
Sanitization: The skill implements several mitigation strategies: it requires a scan_status: clean check before processing, limits text to 10,000 characters, ignores embedded requests for secrets or shell commands, and strictly mandates human-in-the-loop approval for all customer-facing writes.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes an external Model Context Protocol (MCP) tool server hosted at https://console.mermail.app/mcp to provide workspace and mailbox management functionality.

mermail-support-agent