The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation requires running a setup.sh shell script during installation. Because the content of this script is not included in the provided manifest and originates from an unverified source, its actions cannot be audited, posing a risk of unauthorized command execution.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill retrieves untrusted data from external IMAP servers, including email subjects and message bodies, via the fetch and search commands in scripts/imap.js.
Boundary markers: The instructions lack specific delimiters or directives to ensure the agent treats incoming email content as passive data rather than executable instructions, making it vulnerable to embedded prompts.
Capability inventory: The skill includes powerful capabilities such as sending emails via SMTP and writing files to the local system. These tools could be leveraged to exfiltrate sensitive data if the agent is manipulated by instructions hidden within a received email.
Sanitization: No sanitization, filtering, or validation protocols are described for the external data ingested by the skill.
[CREDENTIALS_UNSAFE]: The skill instructs the user to store plaintext email credentials, including IMAP/SMTP passwords or authorization codes, in a local .env file. These credentials represent highly sensitive information that could be targeted by other malicious processes or via the aforementioned injection surface.

imap-smtp-email