The Agent Skills Directory

[DATA_EXFILTRATION] (MEDIUM): The script scripts/send_email_notification.py facilitates network communication via SMTP to non-whitelisted servers. While intended for notifications, it can be exploited as an exfiltration vector if an agent is coerced into passing sensitive data (e.g., file contents or environment variables) into the --summary or --task-title arguments.
[CREDENTIALS_UNSAFE] (MEDIUM): The SKILL.md documentation instructs users to store sensitive SMTP credentials, including passwords, in cleartext in ~/.bashrc or ~/.zshrc. Since AI agents often have the capability to read these configuration files or access the environment, this significantly increases the risk of credential theft.
[INDIRECT_PROMPT_INJECTION] (MEDIUM): The skill possesses an indirect injection surface by reading the AGENTS.md file to extract project metadata.
Ingestion points: scripts/send_email_notification.py reads the content of AGENTS.md using Path.read_text().
Boundary markers: No delimiters or instructions are used to distinguish the file content from the agent's logic.
Capability inventory: The skill can perform network operations via smtplib.
Sanitization: The script uses basic regex extraction and quote stripping but does not validate or sanitize the resulting strings before including them in the email body.

email-notify