The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes email content from live Outlook profiles, MSG files, and PST archives to extract tasks, decisions, and deadlines. An attacker could send crafted emails containing instructions or payloads designed to influence the agent's behavior or manipulate generated reports.
Ingestion points: live Outlook access (outlook_com.py), MSG file parsing (msg_import.py), and PST archive ingestion (pst_import.py).
Boundary markers: The SKILL.md instructions include behavioral constraints (e.g., "Ask before high-impact actions"), but no technical sandbox is present for processing mail bodies.
Capability inventory: The skill can modify the local Outlook mailbox and calendar (execute_outlook_actions.py), write files to the filesystem (report_exports.py), and execute shell commands via subprocess (report_exports.py).
Sanitization: Content is escaped during DOCX generation and parameterized for database operations, but the extraction logic uses regex patterns directly on raw email text.
[DYNAMIC_EXECUTION]: The module skill_paths.py implements a search mechanism that locates scripts in various user-level directories, such as ~/.vscode/skills, ~/.codex/skills, and paths defined by environment variables. These scripts are loaded and executed at runtime, introducing a risk of executing unintended code if those directories are tampered with.
[COMMAND_EXECUTION]: In report_exports.py, the skill uses subprocess.run to call the Python interpreter and execute a recalc.py script. The path to this script is determined dynamically by the search logic in skill_paths.py.
[DATA_EXFILTRATION]: The skill provides comprehensive access to local Outlook data, including message bodies, senders, and attachments. While intended for local processing, the handling of sensitive communication data represents a significant exposure surface.

outlook-mail-assistant