The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/read_emails.py script automatically fetches images from external URLs found in HTML email bodies using urllib.request.urlopen. While limited to images, this behavior allows for automated downloads from arbitrary remote servers based on untrusted email content.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it ingests untrusted data from email bodies and presents it to the agent for summarization.
Ingestion points: Email bodies are fetched via IMAP in scripts/read_emails.py.
Boundary markers: The skill lacks explicit boundary markers or instructions telling the agent to ignore embedded commands within the email content.
Capability inventory: The skill can write files to the local system (attachments and images) and execute subprocesses (via listen_emails.py).
Sanitization: The script performs basic HTML sanitization (removing <script> and <style> tags) but does not validate the content for adversarial instructions.
[COMMAND_EXECUTION]: The scripts/listen_emails.py script utilizes subprocess.run to automate the execution of the email reading script and to trigger macOS system notifications via osascript. While the arguments are largely controlled, the use of shell-level execution to handle external data (like email subjects in notifications) introduces a potential injection surface if not perfectly escaped.

z-mail-reader