The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructions direct the agent to access and source the user's ~/.zshenv file to retrieve the AGENTMAIL_API_KEY. Shell profile files are sensitive locations that often contain credentials and private configurations for various services.
File: SKILL.md
Evidence: "If it is missing, the key lives in ~/.zshenv; source it rather than asking the user to paste it again."
[INDIRECT_PROMPT_INJECTION]: This skill is designed to ingest and process email content from external senders, which is a primary vector for indirect prompt injection. Malicious instructions embedded in an email (e.g., in the body or metadata) could be interpreted by the agent as commands.
Ingestion points: The skill fetches external content via GET /v0/inboxes/{inbox_id}/messages and the scripts/wait-for-email.sh polling script.
Boundary markers: While the skill suggests using extracted_text to strip reply trails, it does not mandate the use of defensive delimiters or "ignore instructions" headers when presenting email content to the agent.
Capability inventory: The agent has the ability to execute network commands (curl), write to the file system (as seen in attachment recipes), and interact with other tools in the agent environment.
Sanitization: No sanitization or safety-filtering logic for the incoming email body is provided or required by the instructions.

agentmail