The Agent Skills Directory

[COMMAND_EXECUTION]: The skill bundles and executes several platform-specific binary files, including himalaya, cola-credential-helper, and cola-outlook-mail-auth located in the scripts/bin/ directory. While himalaya is an open-source tool, the cola-* binaries are custom components created by the author to handle sensitive email credentials. Executing opaque binaries is a security risk because their internal logic and potential for data exfiltration cannot be audited through the skill instructions.
[PROMPT_INJECTION]: The instructions in SKILL.md explicitly tell the assistant to hide technical implementation details from the user. It states that 'Implementation details never reach the user' and specifically forbids mentioning the tools or configuration files used (e.g., himalaya, CLI, config files, TOML). This lack of transparency, while framed as a branding guideline, prevents the user from knowing which code is actually running on their system.
[PROMPT_INJECTION]: The skill processes untrusted data from external emails, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through the envelope list and message read commands (defined in SKILL.md) which fetch content from external mail servers.
Boundary markers: There are no explicit delimiters or 'ignore embedded instructions' warnings provided to the agent to isolate potential commands hidden within the retrieved email content.
Capability inventory: The agent possesses extensive capabilities including composing, forwarding, moving, and deleting emails, as well as executing local binaries.
Sanitization: No evidence of input sanitization or filtering is provided for the data retrieved from external messages, although the skill does require user confirmation for write operations.

universal-email