The Agent Skills Directory

[DATA_EXFILTRATION]: The skill package contains a cache/ directory with emails.json and last_summary.txt. These files contain actual email metadata from the author's personal/test accounts (2067089451@qq.com and aaqwqaa68@gmail.com), exposing private information including subject lines from Alibaba Cloud, GitHub security alerts, and news subscriptions.
[COMMAND_EXECUTION]: The scripts/email_client.py script invokes subprocess.run to interact with the pass utility for retrieving credentials. While this is an intended and relatively secure design for credential storage, it involves executing shell commands with arguments derived from the config/accounts.json configuration file.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external email sources to generate AI summaries and reply drafts.
Ingestion points: scripts/email_client.py fetches email subjects and bodies from remote IMAP servers.
Boundary markers: The skill does not use delimiters or specific instructions to separate untrusted email content from the agent's core logic.
Capability inventory: The skill has the capability to read/write local files (scripts/check_email.py, scripts/reply_draft.py) and send emails via SMTP (scripts/send_email.py).
Sanitization: The code lacks sanitization or validation of the email body content, which could allow an attacker to influence the agent's summaries or draft responses through specially crafted emails.

email-manager