The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx -y @gongrzhe/server-gmail-autoauth-mcp to download and execute code from an unverified external source during both initial authorization and as a core part of the agent's tool configuration. Executing unvetted packages via npx poses a high risk of supply chain attack.
[DATA_EXFILTRATION]: The skill directs the user to store highly sensitive Google Cloud Platform OAuth keys (gcp-oauth.keys.json) and Gmail access tokens (credentials.json) in the ~/.gmail-mcp/ directory. These credentials are then processed by the third-party package mentioned above, creating a risk of credential harvesting or unauthorized data access.
[PROMPT_INJECTION]: The 'Channel Mode' implementation introduces a significant vulnerability to indirect prompt injection by processing incoming emails and interpolating their content directly into the agent's prompt in src/index.ts.
Ingestion points: Email bodies fetched via the Gmail MCP in checkForNewEmails().
Boundary markers: The skill uses <email> and <body> tags but does not provide explicit instructions to the AI to ignore any malicious commands contained within those tags.
Capability inventory: The agent is granted tools to send emails, list labels, and interact with the local filesystem and shell.
Sanitization: There is no evidence of content filtering or sanitization before the email body is passed to the LLM.
[COMMAND_EXECUTION]: The skill executes various shell commands to modify the environment, including launchctl for service management, mkdir for credential storage, and ./build.sh for rebuilding the local container environment with the new Gmail integration.

add-gmail