The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data in the form of email content, which presents an indirect prompt injection surface. A malicious email could contain hidden instructions that influence the AI agent's behavior.
Ingestion points: The scripts scripts/receive.js and scripts/get-body.js read email subjects, summaries, and full bodies.
Boundary markers: There are no delimiters or boundary markers used to isolate the fetched email content from the agent's internal reasoning or subsequent instructions.
Capability inventory: The skill provides the ability to send emails (scripts/send.js), which could be abused if the agent is tricked by a malicious incoming email.
Sanitization: scripts/get-body.js performs basic HTML tag stripping, but this is insufficient to sanitize natural language instructions.
[DATA_EXFILTRATION]: The scripts scripts/get-body.js and scripts/receive.js configure the IMAP connection with tlsOptions: { rejectUnauthorized: false }. This explicitly disables SSL/TLS certificate verification. While targeting the well-known service imap.qq.com, this configuration makes the connection vulnerable to Man-in-the-Middle (MitM) attacks, potentially exposing the email credentials (QQ_EMAIL_AUTH_CODE) or email data to an attacker on the network.

qq-email