The Agent Skills Directory

[DATA_EXFILTRATION]: The skill manages sensitive IMAP and SMTP credentials used to communicate with a mailbox.
Evidence: Environment variables such as EMAIL_IMAP_PASSWORD and EMAIL_SMTP_PASSWORD are defined in lionclaw.toml and README.md.
Context: The architecture explicitly isolates these credentials on the host side. The SKILL.md and README.md state that runtime agents never receive mailbox credentials or raw mail transport access, mitigating exfiltration risks from the AI context.
[INDIRECT_PROMPT_INJECTION]: The skill processes external email messages, which are inherently untrusted and could contain malicious instructions.
Ingestion points: The runtime/email/SKILL.md defines how the agent receives email turns (From, Subject, Latest message).
Boundary markers: The skill includes a dedicated 'Safety Rules' section and instructions to treat email body content as 'untrusted external input'.
Capability inventory: The agent can reply to existing threads but is restricted from inventing recipients, forwarding mail, or performing administrative actions (approving/releasing senders) without explicit operator instruction via the lionclaw CLI.
Sanitization: The instructions mandate that the agent must not treat display names as identity and must pause for operator confirmation for production-impacting or sensitive requests.
[COMMAND_EXECUTION]: The skill executes a bundled local binary and helper scripts to manage the background email worker.
Evidence: scripts/worker executes bin/lionclaw-channel-email.
Context: This is a standard platform integration for a dedicated channel. The commands are fixed and do not incorporate unvalidated user input into shell execution.

channel-email