The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to read and process data from external, untrusted senders via Gmail.
Ingestion points: The tools GMAIL_FETCH_EMAILS, GMAIL_GET_EMAIL_BY_ID, and GMAIL_GET_THREAD (referenced in SKILL.md) provide the agent with direct access to untrusted email bodies.
Boundary markers: There are no explicit instructions or delimiters defined to separate user/system instructions from the content of the emails being processed.
Capability inventory: The agent has access to several high-privilege tools, such as GMAIL_SEND_EMAIL, GMAIL_BATCH_MODIFY_MESSAGES, and GMAIL_TRASH_MESSAGE (referenced in SKILL.md), which could be misused if the agent follows malicious instructions found within an email.
Sanitization: The skill lacks specified logic for sanitizing or validating email content before it is processed or used in further tool calls.
[DATA_EXFILTRATION]: The skill is configured to interact with an external API at https://app.rubeai.io/mcp. This workflow involves transmitting potentially sensitive user communication data and the RUBE_API_KEY to a third-party domain that is not part of the established trusted vendor list. While this is the intended purpose of the integration, it represents a data exposure surface.

gmail-manager