The Agent Skills Directory

[PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks because it processes and exposes untrusted data from external email accounts to the agent.
Ingestion points: Email subjects, bodies, and full content are retrieved from remote servers in scripts/imap.js via checkEmails, fetchEmail, and searchEmails.
Boundary markers: There are no protective delimiters or instructions implemented to wrap the untrusted email content before it is returned to the agent context.
Capability inventory: The skill possesses significant capabilities that could be exploited by an injection attack, including reading local files and sending emails via scripts/smtp.js, and writing files to disk via scripts/imap.js.
Sanitization: While the skill performs filename sanitization to prevent path traversal, it does not sanitize or filter the textual content of emails for malicious instructions.
[COMMAND_EXECUTION]: The skill's operation relies on the execution of Node.js scripts and includes a shell script (setup.sh) for initialization.
The setup.sh script automates environment configuration and sets file system permissions.
The core functionality requires the agent to execute shell-level commands to interact with the email provider infrastructure.
[CREDENTIALS_UNSAFE]: The skill manages sensitive email authentication credentials, including passwords and authorization codes.
Analysis: The implementation follows security best practices by utilizing a .env file for secret storage and providing a setup script that automatically restricts file permissions (chmod 600). It also explicitly directs users to utilize Application Specific Passwords for providers like Gmail to minimize risk.

email-manager