The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Gmail messages which may contain malicious instructions targeting the AI agent. * Ingestion points: scripts/gmail.py via read and thread subcommands which fetch message bodies from the Gmail API. * Boundary markers: Absent; message content is parsed and returned to the agent without delimiters or instructions to ignore embedded commands. * Capability inventory: scripts/gmail.py provides significant capabilities including sending, replying, and drafting emails, as well as attaching local files and modifying labels. * Sanitization: Absent; email content is decoded from Base64 and provided directly to the agent context as plain text or HTML.
[DATA_EXFILTRATION]: The send and draft commands in scripts/gmail.py include an --attach flag that enables reading arbitrary files from the local filesystem. This capability is part of the primary purpose of a mail client but represents a risk as it could be abused to exfiltrate sensitive data if the agent is influenced by malicious input.

gmail