The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from external email sources.
Ingestion points: Fetches email bodies and attachments from Microsoft Graph API endpoints (e.g., /users/${userId}/messages) as shown in SKILL.md.
Boundary markers: The instructions lack explicit delimiters or warnings to treat incoming email content as data rather than instructions.
Capability inventory: Includes filesystem read/write (fs.readFileSync, fs.writeFileSync) and network transmission via Graph API (sendMail).
Sanitization: The provided code snippets do not include sanitization or validation of the content retrieved from emails, allowing raw HTML or text from external senders to enter the agent's context.
[COMMAND_EXECUTION]: The skill interacts with the filesystem and network to perform its primary functions.
File Access: Reads local files for email attachments and writes received attachments to the disk using Node.js fs module.
Network Access: Makes outbound calls to the Microsoft Graph API to send and manage emails. While legitimate for the skill's purpose, these capabilities represent a risk if combined with untrusted data processing.

outlook-email