The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on external scripts (scripts/auth.py and scripts/gmail.py) to perform authentication and Gmail operations. These files are not provided in the skill package, preventing a full security audit of the code the agent is instructed to execute.
[DATA_EXFILTRATION]: The skill enables the agent to read full email content, headers, and metadata. While this is the intended functionality, it establishes a significant data exposure surface where sensitive user information could be accessed and potentially moved out of the secure environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from Gmail messages which could contain malicious instructions.
Ingestion points: The python scripts/gmail.py get command (SKILL.md) reads the full content of external emails.
Boundary markers: The instructions do not define any delimiters or system instructions to help the agent distinguish between email data and its own command instructions.
Capability inventory: The skill provides a high-privilege capability set including sending emails, creating drafts, and modifying labels (scripts/gmail.py), which could be abused if an injection is successful.
Sanitization: No mention is made of sanitizing or filtering email content before the agent processes or interprets it.

gmail-automation