The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from inbound emails.
Ingestion points: External data enters the agent context via the GET /v3/emails/latest and GET /v3/emails/{id} endpoints mentioned in SKILL.md.
Boundary markers: The instructions do not define delimiters or provide specific warnings for the agent to ignore instructions contained within the email bodies.
Capability inventory: The skill provides capabilities to send messages (POST /v3/messages) and execute network requests via curl, which could be exploited by a malicious email.
Sanitization: There is no description of content sanitization or validation for the inbound email bodies.
[DATA_EXFILTRATION]: The skill enables the agent to send outbound emails, creating a path for data transfer.
The POST /v3/messages endpoint allows sending text or HTML content to external recipients, which could be used to exfiltrate sensitive information from the agent's session.
[COMMAND_EXECUTION]: The skill instructions mention the use of shell commands for API interaction.
SKILL.md suggests using raw curl commands as an alternative to MCP tools, which involves the execution of shell-based network operations.

temporam