The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because its core function involves processing and acting upon untrusted data from incoming emails, calendar invites, and external task managers.
Ingestion points: Processes all unarchived email bodies, subjects, and headers (SKILL.md); reads upcoming calendar meetings and Linear task descriptions.
Boundary markers: No explicit delimiters or instruction isolation techniques are defined for processing the content of fetched emails.
Capability inventory: The skill can archive, label, and snooze emails; create drafts; forward emails to external addresses; and execute network requests for unsubscribing (SKILL.md, references/classification-rules.md).
Sanitization: While the skill requires human approval for sending drafts and processing payments, the classification logic itself (e.g., escalating emails containing 'security alert' or 'urgent') can be manipulated by an attacker to ensure malicious emails bypass triage filters.
[DATA_EXFILTRATION]: The skill performs data transfers to external endpoints based on information found in untrusted emails.
External Requests: The 'Bulk Unsubscribe' feature extracts URLs from List-Unsubscribe headers or email bodies and performs GET requests to those URLs (references/classification-rules.md). This can be abused to trigger tracking pixels or interact with attacker-controlled domains.
Targeted Forwarding: Validated invoices are forwarded to an external financial service at bills@brex.com. While this is an intended feature and requires user confirmation, it constitutes a flow of sensitive financial data out of the user's immediate environment.
[COMMAND_EXECUTION]: The skill utilizes command-line tools and MCP capabilities to manage the environment.
Tool usage: It executes shell commands like which gscli and gscli auth status to verify dependencies (SKILL.md).
Mailbox operations: It performs programmatic operations including gscli gmail list, gscli gmail read, and various Gmail MCP tools to manipulate the user's inbox state based on its triage logic.

inbox-commander