The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes the agent to untrusted data by allowing it to read and process external email content.
Ingestion points: SKILL.md describes methods for fetching email data, including messages, threads, and helper commands like +triage and +watch.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to help distinguish between legitimate data and potential instructions embedded in emails.
Capability inventory: The skill provides a wide range of capabilities, including sending and replying to emails, which could be abused if the agent follows malicious instructions found in an email.
Sanitization: The skill definition does not include steps for sanitizing or validating email content before processing.
[COMMAND_EXECUTION]: The skill facilitates the execution of the gws system binary to interact with the Gmail API.
Evidence: The skill instructions explicitly direct the agent to use gws gmail for all listed resource operations.

gws-gmail