The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill's core workflow depends on fetching tool schemas and execution plans from an external source (RUBE_SEARCH_TOOLS). This creates a vulnerability where a compromised or malicious remote server can inject instructions into the agent's workflow by returning poisoned tool definitions.
Ingestion points: RUBE_SEARCH_TOOLS response, RUBE_GET_TOOL_SCHEMAS response, and data from the emailable service itself.
Boundary markers: Absent. No instructions are provided to the agent to disregard instructions contained within the fetched tool schemas or external data.
Capability inventory: High. The skill uses RUBE_MULTI_EXECUTE_TOOL and RUBE_REMOTE_WORKBENCH which allow for arbitrary tool execution and remote operations.
Sanitization: Absent. There is no evidence of validation or filtering of the content returned by the external service.
[Remote Code Execution / External Downloads] (HIGH): The setup instructions require adding https://rube.app/mcp as an MCP server. This grants a remote, non-trusted third-party endpoint the ability to define and execute tools within the user's agent environment. The RUBE_REMOTE_WORKBENCH tool explicitly enables remote execution of Composio tools.
[Command Execution] (MEDIUM): The skill facilitates the execution of various tools via the Rube MCP. While these are presented as discrete tools, they effectively allow the agent to perform operations with side effects on external platforms based on instructions received from a remote server.
[Metadata Poisoning] (LOW): The description encourages users to add a specific remote endpoint (rube.app) which bypasses standard security review processes for local code.

emailable-automation