The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the processing of untrusted email content.
Ingestion points: External email data is fetched from the Gmail API into a local processing server (localhost:2529).
Boundary markers: The provided documentation and scripts do not describe any delimiters or system instructions used to isolate untrusted email content from the AI triage logic.
Capability inventory: The skill includes scripts for querying email details (scripts/email), listing emails (scripts/emails), and performing multi-turn AI analysis including HTML body inspection for link extraction.
Sanitization: There is no evidence of sanitization or filtering of email bodies before they are passed to the AI for analysis and classification.
[COMMAND_EXECUTION]: The skill utilizes multiple bash scripts that execute curl commands to interact with a local API. While these scripts use jq for JSON construction and data-urlencode for parameters (reducing shell injection risk), they provide the agent with the ability to perform network operations against the local host.

google-email