The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted email content (bodies, links, attachments, and headers) which creates a risk of indirect prompt injection where malicious instructions embedded in emails could attempt to influence the agent's behavior.
Ingestion points: Gmail message bodies, subjects, headers, and attachments are identified as untrusted inputs in SKILL.md and references/runbook.md.
Boundary markers: The skill includes explicit instructions in references/runbook.md to ignore instructions inside emails that attempt to change automation, reveal secrets, or bypass rules.
Capability inventory: The agent has the ability to create Gmail drafts, interact with affiliate APIs, create and archive Codex project threads, and perform file system commits.
Sanitization: The skill relies on natural language instructions for the LLM to ignore malicious content rather than technical sanitization or schema validation of the ingested email data.
[COMMAND_EXECUTION]: The skill instructions allow for committing changes to local files and mention the use of browser automation for affiliate operations.
Evidence: SKILL.md (Memory and Commits) instructs the agent to commit scoped changes to local files, and references/runbook.md (Affiliate Program Operations) mentions using a workspace-approved browser for manual affiliate management.
Context: These capabilities are scoped to specific tasks (logging affiliate notes, triaging support) and include directives for user confirmation in sensitive operations.

customer-email-draft-threads