The Agent Skills Directory

[PROMPT_INJECTION]: The skill presents an indirect prompt injection attack surface because it is designed to ingest and process untrusted data from external sources (incoming emails) and possesses capabilities that could be abused if the agent obeys instructions hidden within those emails.
Ingestion points: Untrusted data enters the agent context through GMAIL_FETCH_EMAILS, GMAIL_FETCH_MESSAGE_BY_MESSAGE_ID, and the processing of email attachments.
Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags or triple backticks) or specific warnings to the agent to ignore instructions embedded in the retrieved email content.
Capability inventory: The skill provides access to sensitive tools including GMAIL_SEND_EMAIL, GMAIL_REPLY_TO_THREAD, GMAIL_DELETE_LABEL, and GMAIL_BATCH_MODIFY_MESSAGES.
Sanitization: There is no evidence of content filtering, sanitization, or validation performed on the retrieved email body or metadata before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The documentation references external resources including the Rube MCP server at https://rube.app/mcp and the official Composio documentation. These are well-known services associated with the skill's stated purpose and do not involve the automated download or execution of untrusted scripts.
[NO_CODE]: The skill is composed entirely of YAML metadata and Markdown instructions. It does not include any accompanying Python scripts, JavaScript files, or binary executables, which significantly limits the risk of direct malicious code execution or persistence.

gmail-automation