The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted data from external emails, which creates a surface for indirect prompt injection attacks.
Ingestion points: The gmail_skill.py script fetches email bodies, snippets, and contact details via the read, search, list, and contacts commands.
Boundary markers: Although the script returns data in structured JSON format, it does not include explicit delimiters or instructions to the agent to prevent the interpretation of email content as instructions.
Capability inventory: The skill possesses high-privilege capabilities, including sending emails (cmd_send), creating drafts (cmd_draft), and modifying contact information.
Sanitization: Email bodies and snippets are decoded and returned to the agent as plain text without filtering or sanitization of potential prompt injection patterns.
[DATA_EXFILTRATION]: The skill facilitates access to highly sensitive user information, including personal emails and contacts.
Evidence: gmail_skill.py implements functions to read full email contents, download attachments (cmd_attachment), and list detailed contact information.
Note: This behavior is consistent with the skill's primary function and relies on trusted Google APIs, but it provides the agent with access to sensitive data that could be exfiltrated if the agent is compromised.
[COMMAND_EXECUTION]: The skill performs several system-level operations to manage authentication and data storage.
Evidence: The script starts a local HTTP server (OAuthCallbackHandler) for OAuth redirection, uses webbrowser.open to handle authentication flows, and writes tokens and attachments to the local file system.

gmail-skill