The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted data from email bodies and calendar events, creating a surface for indirect prompt injection where malicious instructions in an email could influence agent behavior.
Ingestion points: scripts/outlook-mail.sh and scripts/outlook-calendar.sh fetch content from external sources.
Boundary markers: The scripts do not use delimiters or instructions to isolate untrusted content from the agent's instructions.
Capability inventory: The skill includes tools to send emails, delete messages, and modify calendar entries, which could be abused if an injection is successful.
Sanitization: Basic HTML tag removal is performed, but no semantic filtering for malicious instructions is implemented.
[COMMAND_EXECUTION]: The skill relies on shell scripts that interpolate user-provided arguments into curl commands and jq filters.
Evidence: Arguments such as subject, body, and search queries are directly inserted into JSON payloads and URL strings in scripts/outlook-mail.sh and scripts/outlook-calendar.sh, which could allow for JSON structure manipulation or URL parameter injection.
Evidence: The attachment download command in scripts/outlook-mail.sh is potentially vulnerable to path traversal if a message contains an attachment with a malicious filename.
[DATA_EXFILTRATION]: The skill is designed to read and manipulate sensitive user information, including full email content and calendar metadata.
Evidence: The skill facilitates access to private communications and schedules as part of its core functionality.
[EXTERNAL_DOWNLOADS]: The scripts interact with well-known Microsoft services for data management and authentication.
Evidence: Network requests are made to official endpoints including graph.microsoft.com and login.microsoftonline.com.

outlook