The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (ls) to inspect the user's file system across multiple sensitive paths, including hidden directories like ~/.claude/skills/ and ~/.agent/skills/.
[DATA_EXFILTRATION]: By scanning directories such as ~/.claude/skills/, the skill probes for and potentially exposes the list of installed AI agent skills and the user's directory structure to the agent's context without explicit user authorization for this specific scan.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to ingest and process untrusted external data such as SMTP headers, DNS records, and bounce messages.
Ingestion points: User-supplied email headers, DNS TXT records, and Delivery Status Notifications (DSNs) described in SKILL.md and references/bounce-handling.md.
Boundary markers: The instructions do not define any delimiters or warnings to ignore instructions embedded within the processed data.
Capability inventory: The agent has the capability to execute shell commands (ls) and is instructed to recommend software installation commands (npx skills add).
Sanitization: There are no instructions for sanitizing, escaping, or validating the external content before the agent processes it.
[COMMAND_EXECUTION]: The skill instructs the agent to suggest execution of npx commands for installing additional 'companion' skills based on the results of the filesystem scan.

email-deliverability