The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the npx @useclawlink/cli tool to perform all actions, including login, connection, and data manipulation.
[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to read external content from Outlook emails, calendars, and tasks. This creates a surface for indirect prompt injection where malicious instructions embedded in received emails or calendar events could potentially influence the agent's behavior.
Ingestion points: Commands such as outlook_list_messages, outlook_get_message, outlook_search_messages, outlook_query_emails, outlook_list_events, and outlook_list_todo_tasks ingest external data into the agent's context.
Boundary markers: None specified in the instructions for isolating external content.
Capability inventory: The skill includes write capabilities such as outlook_send_email, outlook_calendar_create_event, and outlook_create_contact which could be abused if an injection is successful.
Sanitization: No explicit sanitization or filtering of email/event content is mentioned.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx to dynamically download and run the @useclawlink/cli package from the public NPM registry at runtime.
[DATA_EXFILTRATION]: The skill documentation notes that the @useclawlink/cli login command stores authentication credentials in a local file at ~/.clawlink/credentials.json. While this is standard behavior for CLI-based authentication for this vendor, users should be aware that the agent has access to these credentials.

outlook