The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and processes email body content from external, untrusted sources (incoming emails).
Ingestion points: scripts/gmail_unified.py (specifically the get_message_detail function which fetches the full email body).
Boundary markers: Absent. There are no instructions or delimiters provided to the agent to differentiate untrusted email content from its own system instructions.
Capability inventory: The skill can send emails (send_message), reply to threads (reply_to_message), and modify labels. The agent also has access to the Bash tool for general system operations.
Sanitization: Absent. Email bodies are decoded from Base64 and returned as plain text without filtering or validation.
[DATA_EXFILTRATION]: The inclusion of email-sending capabilities (gmail.send scope) allows the agent to transmit data externally. In an adversarial scenario triggered via indirect prompt injection, this could be used to exfiltrate sensitive information accessed by the agent.
[COMMAND_EXECUTION]: The skill executes local Python scripts to interact with the Gmail API. These scripts manage sensitive OAuth tokens and account configurations (credentials.json, token_*.json, gmail_accounts.json).
[EXTERNAL_DOWNLOADS]: The skill relies on standard, well-known libraries for authentication and API interaction, including the Google API client libraries and python-dotenv.

gmail-inbox