The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external emails and web pages.
Ingestion points: Email subjects and bodies are read from ~/.claude/inbox/queue.json, and web content is retrieved via WebFetch based on URLs in those emails.
Boundary markers: No delimiters or instructions are used to isolate untrusted content from the agent's core instructions.
Capability inventory: The agent can execute local Python scripts, read/write local files (including sensitive project data in NOW.md), and perform network operations.
Sanitization: There is no evidence of sanitization or filtering of the external data before processing.
[CREDENTIALS_UNSAFE]: The setup instructions require the user to store a sensitive Google App Password in plain text within a configuration file (~/.claude/inbox/config.json). This exposes long-lived credentials to any process that can read the file system.
[COMMAND_EXECUTION]: The skill relies on executing a local Python script (~/.claude/scripts/inbox-fetch.py) to synchronize the email queue and clear it after processing. While intended for the skill's functionality, this provides a mechanism for local code execution.

inbox