The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from incoming email threads and external data sources (such as Slack, Coda, or Notion) to generate draft replies. This creates an attack surface where malicious instructions embedded in an email could attempt to hijack the drafting process.
Ingestion points: Superhuman_Mail.get_thread, Superhuman_Mail.query_email_and_calendar, and third-party context searches (Slack, Linear, etc.) as described in Step 1.5.
Boundary markers: The instructions do not specify the use of delimiters or boundary markers when interpolating untrusted data into prompts for the AI writer.
Capability inventory: The skill uses Superhuman_Mail.create_or_update_draft and Superhuman_Mail.send_draft, giving it the ability to generate and transmit content.
Sanitization: There is no instruction to sanitize, filter, or escape the content of external messages before they are used to inform drafts.
Mitigation: The skill includes robust human-in-the-loop requirements in Step 3 (Present the plan) and Step 5 (Present results and offer to send), which significantly reduces the risk of automated malicious actions by ensuring the user reviews all intended responses.

batch-draft-writer