The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill allows the definition of email_triage_instructions which are documented to be injected directly into the AI's system prompt during email analysis. This establishes an attack surface where malicious input or adversarial instructions could manipulate the agent's triage behavior.
Ingestion points: The email_triage_instructions field in SKILL.md (Step 6) and the scripts/update-account wrapper.
Boundary markers: There are no delimiters or 'ignore' instructions mentioned to separate the triage text from the agent's core system prompt.
Capability inventory: The skill uses multiple bash scripts (sync-emails, create-account, get-account, update-account, add-alias) to interact with a local assist server at localhost:2529.
Sanitization: The instructions field is described as 'plain text' and no sanitization or escaping is indicated before injection.
[COMMAND_EXECUTION]: The skill uses local shell scripts in the scripts/ directory to communicate with a local API. The scripts/get-account script interpolates the account ID parameter directly into a URL string (${SERVER}/api/google/accounts/$1) without validation or sanitization, which could lead to path traversal or unexpected API requests if the agent is provided with a malicious identifier.

google-account-setup