The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/set_up_mail_automation.py and scripts/set_up_mail_automation.sh execute osascript to interact with Mail.app, which is necessary to trigger the required macOS TCC (Transparency, Consent, and Control) permission prompts.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from incoming emails, creating a surface for injection attacks.
Ingestion points: Untrusted data enters the context via mail.selection() and mailbox.messages() in scripts/extract_emails_to_contacts.py, scripts/search_and_archive.py, and the rule handlers in references/mail-rules.md.
Boundary markers: None are present to distinguish between instructions and untrusted email content.
Capability inventory: The skill has the capability to write files to disk (attachment extraction), modify the Contacts database, and move or compose emails.
Sanitization: While extract_emails_to_contacts.py uses regex for extraction, the skill lacks comprehensive sanitization or delimiters when processing message bodies or subjects in other workflows.
[PRIVILEGE_ESCALATION]: The setup scripts are specifically designed to trigger and acquire 'Automation' permissions for Mail.app. While functional, this grants the agent extensive access to private communications and contacts if permitted by the user.
[EXTERNAL_DOWNLOADS]: The skill documentation and Python scripts rely on PyXA (Python for Apple Automation). The SKILL.md refers the user to external instructions for installing this third-party dependency.

automating-mail