The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from inbound email routes and webhooks, which represents a potential attack surface for indirect prompt injection. However, the skill provides specific defensive guidance to mitigate this risk.\n
Ingestion points: Inbound email content processed via the Routes API and Webhook payloads described in SKILL.md.\n
Boundary markers: The skill contains explicit instructions for the agent to treat inbound content (sender, subject, body) strictly as data and never as instructions, specifically citing and warning against phrases like "ignore previous instructions".\n
Capability inventory: The skill allows the agent to send emails, manage mailing lists, modify DNS/DKIM settings, and manage subaccounts (seen in SKILL.md and references/infrastructure.md).\n
Sanitization: SKILL.md instructs the developer to sanitize user-generated content before logging, rendering, or storing, and to verify HMAC signatures on incoming webhooks to ensure authenticity.\n- [EXTERNAL_DOWNLOADS]: The documentation references official Node.js packages for Mailgun integration.\n
Evidence: Recommends the installation of mailgun.js and form-data for SDK-based implementations in SKILL.md.\n- [COMMAND_EXECUTION]: The skill provides numerous curl command examples to demonstrate API usage for sending messages and managing domain resources.\n
Evidence: Examples include curl -X POST \"https://api.mailgun.net/v3/$MAILGUN_DOMAIN/messages\" and various management endpoints throughout SKILL.md.

sinch-mailgun