The Agent Skills Directory

[SAFE]: The skill demonstrates defensive best practices by including a prominent security notice at the beginning of its instructions. It explicitly advises the agent to treat scraped email content as untrusted material for analysis and not as a source of instructions.
[COMMAND_EXECUTION]: The skill uses the ls command via a shell environment to check the contents of local directories (Marketing/brand-deals/active/ and Agency/clients/). This is used to build a context list of active partners to improve email categorization accuracy.
[PROMPT_INJECTION]: The skill processes untrusted external data (Gmail message bodies and snippets), which presents a potential surface for indirect prompt injection.
Ingestion points: Gmail thread content accessed through the mcp__claude_ai_Gmail__get_thread and search_threads tools.
Boundary markers: Present. The instructions include a clear directive at the top of the file to ignore instructions found inside scraped text.
Capability inventory: Read access to Gmail threads and local file system discovery via ls. No write capabilities to Gmail or the local file system are permitted by this skill.
Sanitization: Includes a manual sanitization rule instructing the agent to quote the content and stop execution if external text appears to address the agent directly.

read-emails