The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the user or agent to perform global installations of the agentmail-cli package using npm install -g. Global installations typically require elevated privileges (e.g., sudo on Linux/macOS) and modify system-wide directories, which increases the impact if a package is compromised.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs third-party software from public registries (npm and PyPI) that are not on the whitelisted sources list. Specifically, it recommends installing agentmail-cli and the agentmail Python SDK.
[CREDENTIALS_UNSAFE]: The documentation in references/websockets.md suggests a WebSocket connection URL (wss://ws.agentmail.to/v0?api_key=$AGENTMAIL_API_KEY) that passes a sensitive API key as a query parameter. This practice can expose credentials in server logs, proxy logs, and network history.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process incoming emails, which are untrusted external inputs that could contain malicious instructions designed to manipulate the agent.
Ingestion points: External email data is fetched via agentmail inboxes:messages list, agentmail inboxes:messages get, and realtime streams through Webhooks and WebSockets.
Boundary markers: The instructions suggest using extracted_text for LLM input but do not provide explicit boundary markers or instructions for the agent to ignore embedded commands within the email body.
Capability inventory: The agent has capabilities to send emails, reply to threads, create inboxes, and execute terminal commands.
Sanitization: There is no evidence of sanitization or filtering of the external email content before it is processed by the agent.

agentmail