The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/search_inbox.sh and scripts/search_mailbox.sh are vulnerable to command injection. They use double-quoted strings to pass SQL queries to the sqlite3 utility. Because these strings contain shell variables like $field_condition (which incorporates user-provided search terms) and $limit, the shell will perform expansion before executing the command. An attacker-controlled search term containing backticks (e.g., term='id') or subshells will result in arbitrary command execution on the host machine.
[DATA_EXFILTRATION]: The skill accesses the highly sensitive macOS Mail database located at ~/Library/Mail/Envelope Index. This database contains the full history of subjects, senders, and metadata for all accounts configured on the system. The skill also provides a scripts/send.sh tool, creating a potential path for automated data exfiltration if the agent is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it reads raw email content and provides the agent with powerful capabilities to send, delete, or archive messages.
Ingestion points: scripts/read_by_id.sh outputs the full content of emails directly into the agent's context.
Boundary markers: The skill uses a minimal text-based header (--- Content ---) which does not effectively isolate untrusted data from the agent's instructions.
Capability inventory: The skill provides tools for sending (scripts/send.sh), deleting (scripts/delete.sh), and managing emails (scripts/archive_*.sh, scripts/mark_read.sh).
Sanitization: No sanitization is performed on email content beyond simple character length truncation.

email