The Agent Skills Directory

[SAFE]: The skill exclusively utilizes vendor-controlled resources, including the api.theagentmail.net domain and the @agentmail/sdk Node.js package. No unauthorized external communication or third-party dependencies were found.
[SAFE]: Secure authentication patterns are implemented using API key headers, and the skill includes guidance on verifying webhook signatures using HMAC-SHA256 to prevent unauthorized data injection.
[SAFE]: Inherent Indirect Prompt Injection Surface
Ingestion points: The skill ingests untrusted data from inbound email subjects and bodies when the agent lists or retrieves messages (SKILL.md).
Boundary markers: The skill does not currently define delimiters or instructions to ignore commands within processed email content.
Capability inventory: Agent capabilities are scoped to the email API (account management, sending/reading messages, webhooks).
Sanitization: No explicit sanitization or filtering of external message content is shown in the examples.
Note: This surface is characteristic of email-processing tools and is handled within the context of the skill's primary function.

agentmail