The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external emails, creating an attack surface for indirect prompt injection.
Ingestion points: External email content is fetched via gmail search and gmail read tools as described in SKILL.md.
Boundary markers: The skill implements a defensive fencing strategy using <<UNTRUSTED-EMAIL-CONTENT nonce="...">> and requires closing markers with matching nonces to delimit untrusted data.
Capability inventory: The skill leverages Bash tools that can read email content and write files to the local filesystem using the --save-attachments flag.
Sanitization: The skill documentation specifies that HTML is rendered to text, quoted history is stripped by default, and attachment filenames are sanitized to plain basenames to prevent path traversal. It also provides explicit system instructions to the agent to ignore any commands or instructions found within the fenced email content.
[DATA_EXFILTRATION]: The skill accesses sensitive personal data from the user's Gmail inbox. While the skill is defined as read-only and does not exhibit patterns of sending data to unauthorized external domains, the exposure of private communication to the agent's context is a primary function that handles sensitive information.
[EXTERNAL_DOWNLOADS]: The gmail attachments and gmail read tools include functionality to download files from Gmail servers. While these are downloads from a well-known service, the files themselves originate from untrusted external senders.

gmail-read