The Agent Skills Directory

[COMMAND_EXECUTION]: The bash script scripts/send_email.sh performs dynamic execution by using Python heredocs to generate business IDs, construct complex JSON payloads, and parse API response metadata at runtime. While the script uses quoted heredoc delimiters to mitigate some injection risks, the assembly and execution of script content at runtime is a known attack vector.
[DATA_EXFILTRATION]: The skill accesses a sensitive local configuration path at ~/.config/sendgrid-send-email/api_key to store and retrieve the SendGrid API key. While this is part of the skill's primary functionality for credential management, it involves reading and writing to a sensitive configuration directory.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from local files.
Ingestion points: scripts/send_email.sh reads file contents provided via --text-file, --html-file, and --attachment arguments.
Boundary markers: There are no boundary markers or instructions to the agent to ignore embedded commands within the processed file content.
Capability inventory: The skill has significant capabilities including network access (curl), file system operations (read/write), and shell command execution (bash, python3).
Sanitization: No validation or sanitization is performed on the ingested file content to detect or neutralize embedded instructions.

sendgrid-send-email