The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill possesses a high-risk attack surface for indirect prompt injection by processing external content with write-capable tools.
Ingestion points: scripts/gmail.py fetches untrusted data including snippet, subject, and from headers via the _get_message_details method.
Boundary markers: None. The script returns raw data which is directly interpolated into the agent's context.
Capability inventory: The skill includes the create_draft function, which allows for the creation of new email content.
Sanitization: No sanitization or filtering is performed on the ingested email content to prevent it from being interpreted as instructions by the agent.
[Credentials Unsafe] (HIGH): The script manages sensitive OAuth2 credentials and tokens in a predictable local directory.
Evidence: scripts/gmail.py hardcodes CREDENTIALS_DIR to ~/.gmail_credentials/, containing token.json and credentials.json. Access to these files would allow an attacker to hijack the authenticated Gmail session.

gmail