The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted content from external emails and presents it to the agent without protective boundary markers or instructions to ignore embedded instructions. Ingestion points include 'get-emails.sh', 'get-email-by-id.sh', and 'search-emails.sh'. The skill lacks security delimiters or specific system instructions to prevent the agent from obeying commands found within email bodies. The agent's capabilities to send, delete, and archive emails could be abused if it follows malicious instructions from an email. No sanitization is performed on the ingested email data.
[DYNAMIC_EXECUTION]: Several scripts generate and execute AppleScript code by interpolating shell variables directly into 'osascript' heredocs. Scripts such as 'get-email-by-id.sh' (interpolating 'IDS'), 'archive-email.sh', and 'get-emails.sh' insert shell variables into code blocks. While some scripts attempt basic escaping of quotes, the lack of robust sanitization for all interpolated variables could allow for AppleScript injection, potentially enabling unauthorized actions within Apple Mail or the execution of shell commands via AppleScript's 'do shell script' feature.
[DATA_EXFILTRATION]: The skill's primary function involves accessing sensitive personal information, including email bodies, sender/recipient addresses, and subject lines from the local Apple Mail database. This data is then transmitted into the AI agent's processing context, representing a significant data exposure surface.

apple-mail