The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/gmail_search.py utilizes the pickle module to load cached authentication tokens from the local file system.
Evidence: The get_credentials() function in scripts/gmail_search.py calls pickle.load(token) to read ~/.gmail_credentials/token.pickle.
Risk: Data deserialization using pickle is inherently unsafe and can lead to arbitrary code execution if the data source (in this case, the local token file) is tampered with by a malicious actor.
[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted data from external sources (Gmail messages) and presents it to the agent, creating a surface for prompt injection.
Ingestion points: Untrusted email snippets and full message bodies are retrieved via the Gmail API in get_message_details and search_messages (both in scripts/gmail_search.py).
Boundary markers: While the format_markdown function uses Markdown headers and blockquotes, it lacks robust delimiters or explicit instructions to prevent the agent from following commands embedded within email text.
Capability inventory: The skill has the ability to read all emails, download attachments to the local filesystem, and potentially modify or delete messages depending on the configured OAuth scope.
Sanitization: No content filtering or instruction-stripping is performed on the email data before it is returned to the agent context.
[CREDENTIALS_UNSAFE]: The skill requires the user to store sensitive OAuth credentials in a predictable local directory.
Evidence: The script explicitly manages and reads from ~/.gmail_credentials/credentials.json and ~/.gmail_credentials/token.pickle to perform operations.
Context: While this is a standard implementation for desktop-style OAuth flows, these files contain highly sensitive secrets (Client ID, Client Secret, and Refresh Tokens) that grant access to the user's Gmail account.

gmail