The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes a local CLI tool located at ~/.local/bin/levmail to perform its operations. Several commands, including /mail send, /mail broadcast, and /mail claim, take arguments such as <to>, <subject>, and <path> that are often derived from conversation context or external data. The lack of explicit instructions for sanitizing these inputs before they are interpolated into shell commands creates a risk of command injection if the strings contain shell metacharacters.
[PROMPT_INJECTION]: The skill implements a communication protocol that involves reading and processing markdown files from the .lev/mail/ directory. This creates a surface for indirect prompt injection, as the agent may treat instructions found within these external messages as authoritative commands.
Ingestion points: Message files in .lev/mail/ processed by the /mail read and /mail inbox commands.
Boundary markers: None observed; messages are processed as standard markdown without delimiters or safety warnings.
Capability inventory: Shell command execution via the levmail CLI and file system access within the project directory.
Sanitization: No validation or filtering of the message content is specified in the instructions.
[DATA_EXFILTRATION]: The skill provides the ability to send and broadcast messages, which serves as a data transmission channel. While intended for coordination, this capability could be abused by an attacker to move sensitive information out of the current session's immediate context into shared directories or other agent sessions.

mail