The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a system that ingests external data from event sources (such as a database's incident or invoice tables) to trigger automated email delivery. This creates an attack surface for indirect prompt injection if the content of these events is not properly sanitized before being processed or included in outbound communications.
Ingestion points: Data enters the system from event tables like public.incidents via database triggers in references/delivery.md.
Boundary markers: The design lacks explicit delimiters or instructions to isolate potentially untrusted event content within the email generation pipeline.
Capability inventory: The skill possesses database write permissions for outbox/receipt management (references/delivery.md) and performs network operations via external email provider APIs (SKILL.md).
Sanitization: The skill mitigates log exposure by recording only IDs and counts, but does not specify sanitization or escaping protocols for the data being sent to recipients.
[PRIVILEGE_ESCALATION]: The proposed database architecture in references/delivery.md utilizes security definer functions for triggers to enable restricted roles to initiate email events. Although the skill documents critical security mitigations—such as setting an empty search_path and pinning functions by signature—any misconfiguration of these elevated-privilege functions could be leveraged for privilege escalation within the database environment.
[DATA_EXFILTRATION]: The skill performs network operations using fetch to interact with Postmark and Resend APIs as described in SKILL.md. These interactions are necessary for the skill's primary functionality and target well-known, reputable transactional email services.

transactional-email