The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (incoming emails), which introduces an indirect prompt injection surface where a malicious email could attempt to influence the agent's behavior.
Ingestion points: Data enters the context through Gmail MCP search and read tools (SKILL.md, Phase 1).
Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands within the fetched email bodies.
Capability inventory: The skill is permitted to use Bash, Write, Read, and Glob tools.
Sanitization: No specific sanitization or filtering of email content is described before processing or summary generation.
[COMMAND_EXECUTION]: The skill requests access to the Bash tool. While no specific malicious commands are present, the combination of shell access and the processing of untrusted external content (emails) increases the risk profile if the agent is subverted by malicious input.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill is designed to read, summarize, and persist sensitive academic and personal data from email and calendar services to local markdown files in the quality_reports/inbox/ directory. The instructions include a reference to confidential-data.md to prevent the storage of attachments or credentials in these files.

triage-inbox