The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the Apple Mail directory at ~/Library/Mail/ to read the Envelope Index SQLite database and individual .emlx message files. This allows access to sensitive personal information, including email subjects, senders, and full message content. While this is the skill's stated purpose, it represents a significant data exposure surface.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from incoming emails and provides them to the agent's context, creating a surface for indirect prompt injection attacks where malicious email content could attempt to override agent instructions.
Ingestion points: scripts/mail-search reads email metadata and content from the local Apple Mail SQLite database and message files.
Boundary markers: The output format lacks explicit delimiters or instructions for the agent to ignore instructions found within the processed messages.
Capability inventory: The script is limited to read operations and does not have file-write or network capabilities within the provided files.
Sanitization: No sanitization or filtering of email content is performed before outputting to the agent.
[COMMAND_EXECUTION]: The script uses subprocess.run to execute osascript for querying Mail.app account names. While limited to a specific AppleScript, this requires automation permissions on macOS and represents an interface to system-level functionality.

apple-mail-search