The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external emails, which could contain instructions designed to manipulate the agent's behavior.
Ingestion points: scripts/receive.js and scripts/get-body.js ingest email subjects, sender information, and bodies.
Boundary markers: None are defined to separate the ingested email content from the agent's instructions.
Capability inventory: The skill includes the ability to send emails via scripts/send.js and perform network operations.
Sanitization: scripts/get-body.js provides basic HTML stripping via htmlToText, but this does not prevent instructions embedded in the text from being processed.
[DATA_EXFILTRATION]: The skill handles sensitive authentication credentials and email content over a connection with weakened security.
Evidence: In scripts/receive.js and scripts/get-body.js, the imapConfig object explicitly sets tlsOptions: { rejectUnauthorized: false }.
Risk: Disabling certificate validation allows the connection to proceed even if the server's identity cannot be verified. This makes the session, including the QQ_EMAIL_AUTH_CODE and the emails themselves, vulnerable to interception via Man-in-the-Middle (MitM) attacks.

qq-email