The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts scripts/mail_send_with_cc.py and scripts/mail_unread_summary.py use the subprocess.run function to execute the local dws binary. These operations are essential for the skill's purpose and are implemented securely by passing arguments as lists, which prevents shell injection.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it retrieves and processes external content from email bodies.
Ingestion points: Email data is ingested via the message get command in references/mail.md and the search function in scripts/mail_unread_summary.py.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat email content as untrusted or to ignore instructions embedded within the text.
Capability inventory: The agent can perform sensitive actions such as sending emails (message send) and deleting or moving messages (batch-delete, batch-move).
Sanitization: The skill does not perform any validation or cleaning of the email content before it is processed by the agent.

dingtalk-mail