The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install third-party community tools from personal GitHub repositories (jmhron/FastMailMCP and MadLlama25/fastmail-mcp). These sources are not officially verified or hosted by the platform vendor, representing a supply chain risk.
[REMOTE_CODE_EXECUTION]: The documentation includes steps to execute remote code installation commands, such as git clone followed by pip install -r requirements.txt and npx @anthropic-ai/dxt pack. These commands download and execute content from external, untrusted sources.
[PROMPT_INJECTION]: The skill uses a self-referential mechanism where the agent is instructed to read from and append to references/learnings.md. This creates a surface for indirect prompt injection (Category 8), as malicious instructions could be persisted in the learnings file during one session and influence the agent's behavior in subsequent sessions.
Ingestion points: The agent reads references/learnings.md at the start of every invocation to gather accumulated knowledge.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the learnings.md file.
Capability inventory: The agent has the ability to read and write to local reference files and is encouraged to provide shell commands for API interaction and tool setup.
Sanitization: The skill lacks sanitization or validation logic for the content being appended to the learnings file.

sales-fastmail