The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted incoming email data from Gmail, which could be used by an external attacker to attempt to manipulate the agent's behavior, scoring outcomes, or report generation.
Ingestion points: Untrusted data is ingested through the mcp__claude_ai_Gmail__gmail_read_message tool as described in references/gmail-retrieval.md.
Boundary markers: While the skill strips signatures and disclaimers and attempts to parse content into structured fields, it does not use explicit boundary markers (such as XML tags or dedicated delimiters) with instructions to the agent to ignore any natural language commands found within the email body.
Capability inventory: The skill has significant capabilities across its referenced files, including shell access via Bash, file system access via Write, and database access via mcp__claude_ai_Supabase__execute_sql. It can also create drafts in Gmail.
Sanitization: The skill mitigates risks by implementing a strict JSON extraction schema (references/lead-extraction.md), a structured scoring model (references/scoring-model.md), and a hard rule requiring human review before any email is sent (SKILL.md).

gmail-to-crm-pipeline