The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file references/agentmail-setup-log.md contains a hardcoded API key (am_us_7bd6831fbba7c6996f0c60bce223865babf26d147747044befea0c5fc68374f1) for the AgentMail service. While SKILL.md correctly suggests using environment variables ($AGENTMAIL_API_KEY), the presence of the real key in documentation logs is a high-risk security finding.
[COMMAND_EXECUTION]: The skill makes extensive use of curl commands and Python requests to interact with an external API. While these are necessary for the skill's purpose (email management), they represent a capability that could be misused if instructions are modified by malicious inputs.
[INDIRECT_PROMPT_INJECTION]: The skill processes external email content (reading message bodies and threads). This is a known attack surface where a malicious email could contain instructions designed to trick the AI agent. The skill currently lacks explicit boundary markers (e.g., XML tags or delimiters) or instructions to the agent to treat email content as untrusted data.
Ingestion points: Reading messages via GET /v0/inboxes/{inbox_id}/messages/{message_id} (documented in SKILL.md).
Boundary markers: None identified; email text is printed or processed directly.
Capability inventory: Subprocess calls via curl, file system access for environment variables, and network operations to api.agentmail.to.
Sanitization: No evidence of sanitization for incoming email text before it enters the agent's context.

agentmail