The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from email bodies and threads via commands documented in references/workflows/mail/workflow.md. An attacker could send an email containing malicious instructions designed to manipulate the agent's behavior.
Ingestion points: Data enters the context through the output of feishu-cli mail message, feishu-cli mail messages, and feishu-cli mail thread.
Boundary markers: The instructions lack specific guidance for the agent to use delimiters or ignore instructions embedded within the processed email text.
Capability inventory: The skill allows sending emails, deleting messages, and modifying mailbox states via feishu-cli, in addition to file system access via the Write tool.
Sanitization: The underlying CLI implementation includes defenses against SMTP header injection and path traversal for inline images, but the prompt logic does not explicitly handle natural language instruction overrides.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute feishu-cli commands. While this is the intended functionality, it grants the agent the ability to execute shell commands with user-supplied arguments (e.g., subject lines, body content), which relies on the CLI's internal sanitization.
[DATA_EXFILTRATION]: The skill is designed to handle sensitive communications and PII within emails. The combination of reading capabilities (triage/message) and sending capabilities (send/forward) creates a technical surface for data exfiltration if the agent were to be misled into forwarding sensitive contents to an external address.

feishu-cli-mail