The Agent Skills Directory

[COMMAND_EXECUTION]: A directory traversal vulnerability exists in scripts/process_feedback.py. The download_attachment function constructs a local file path by joining a base directory with a filename derived directly from email metadata (p.get("filename")). Since this input is not validated or sanitized, an attacker could send an email with an attachment named using traversal sequences (e.g., ../../.bashrc) to overwrite sensitive files or install malicious scripts on the agent's host system.- [INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection attacks because it ingests and displays untrusted data from external emails to the agent.
Ingestion points: Email subjects, message bodies, and attachment filenames are fetched from Gmail and stored in local files (report.json and body text files) by scripts/process_feedback.py.
Boundary markers: No delimiters, structural wrapping, or instructions to ignore embedded commands are present in the skill's instructions or the script's output.
Capability inventory: The agent is empowered to modify the codebase (via grep and manual editing), create GitHub issues, and send email replies based on the feedback content.
Sanitization: The script performs no filtering or escaping of the email content, allowing malicious instructions to be passed directly into the agent's context.- [COMMAND_EXECUTION]: The Python script scripts/process_feedback.py relies on an external CLI tool named gws to interact with Google APIs. This introduces a dependency on a non-standard binary that is not managed by the skill's packaging and must be present in the environment, which could be exploited if a malicious version of the tool is installed.

client-feedback