The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to ingest untrusted data from external sources (email messages) which may contain malicious instructions designed to influence agent behavior.
Ingestion points: Untrusted content is retrieved from email bodies and subjects via commands like superhuman inbox, superhuman search, and superhuman read (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between its own instructions and the content of retrieved emails.
Capability inventory: The agent has access to high-impact tools that can be misused if an injection is successful, including superhuman send, superhuman reply, superhuman archive, superhuman delete, and superhuman attachment download (SKILL.md).
Sanitization: There is no evidence of sanitization or filtering of email data before it enters the agent's context.
[CREDENTIALS_UNSAFE]: The skill performs automated extraction and caching of sensitive authentication credentials.
Evidence: The superhuman account auth command extracts OAuth access and refresh tokens from the Superhuman application via the Chrome DevTools Protocol and stores them in a local JSON file at ~/.config/superhuman-cli/tokens.json. While necessary for the skill's operation, this file contains long-lived credentials for the user's email accounts.
[COMMAND_EXECUTION]: The skill is configured with broad tool permissions (Bash(superhuman:*)), allowing the agent to execute any subcommand of the superhuman CLI. This gives the agent extensive control over the user's email environment, including reading, sending, and deleting messages.

superhuman