The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the user's private Apple Mail storage located at ~/Library/Mail. This directory contains sensitive personal information, including full email contents, sender/recipient details, and private file attachments.
[COMMAND_EXECUTION]: The script is susceptible to command injection in multiple functions. Specifically, in cmd_attachment, the msg_id variable is directly interpolated into a mktemp command: mktemp -d -t "mail-attachments-${msg_id}-XXXXXX". An attacker or a malicious prompt could provide a message ID containing shell commands (e.g., $(rm -rf ~)) which would be executed by the host shell.
[COMMAND_EXECUTION]: The script performs unsafe SQL construction in the cmd_search function. User-provided inputs, such as the --limit argument, are appended directly to SQL strings without sanitization or parameterization (e.g., LIMIT $limit). This enables SQL injection attacks that could manipulate database queries.
[PROMPT_INJECTION]: The skill facilitates Indirect Prompt Injection by reading and presenting untrusted email content to the agent. An attacker could send a specifically crafted email that, when read by the agent, triggers unintended actions.
Ingestion points: Email subjects, summaries, and full RFC822 bodies are read from .emlx files and the Envelope Index SQLite database.
Boundary markers: The script does not use delimiters or instructions to prevent the agent from obeying commands embedded within the retrieved emails.
Capability inventory: The toolset includes searching, reading metadata, reading full messages, and copying attachments to /tmp/ using system utilities like sqlite3, find, and cp.
Sanitization: There is no validation of the msg_id or other CLI arguments before they are used in shell commands or SQL queries, beyond a rudimentary attempt to escape single quotes in some search fields.

apple-mail