The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data (email bodies and newsletter content) that is then processed by the agent for categorization and summarization.
Ingestion points: Raw email content is fetched via gws gmail users messages get and processed by scripts/extract_newsletter.py before being presented to the agent context.
Boundary markers: There are no explicit instructions or delimiters (like XML tags or 'ignore' prefixes) defined in the workflow to separate the email content from the agent's core instructions.
Capability inventory: The skill has access to shell execution via gws (Google Workspace CLI) and localized scripts. It can modify account state by marking emails as read.
Sanitization: The extract_newsletter.py script performs basic HTML stripping and character limiting but does not sanitize for embedded instructions that could attempt to manipulate the agent's output or actions.
[COMMAND_EXECUTION]: The skill relies on local shell commands (gws, bash, python) to interact with the Gmail API. While these are part of the intended functionality, they use string-interpolated JSON parameters (--params and --json) which could be a target for injection if the email IDs or inputs were maliciously crafted.

gmail-triage