Recipe Save Email To Doc Skill Security Audit

The recipe retrieves message content and then places the body inside a single-quoted shell argument. If an agent directly substitutes the real body, an apostrophe in sender-controlled text could close the argument and allow following shell syntax to run, affecting the user's files, credentials, or accounts. No escaping or file/stdin-based transfer is specified. This supports an exploitable command-construction risk, not proof that any email caused execution. Users can ask the author to pass the body without shell interpolation.

The query and title appear to be recipe examples rather than necessarily real values. Step 1 lists matches in a table, and the later `MSG_ID` still requires selection, providing an opportunity to inspect results. However, the recipe does not explicitly require confirmation of the chosen message, account, or body scope. If an agent automatically selects the wrong match, it could copy an unintended full email into a new document. The source does not show result count, selection behavior, or the user's authorization scope, so the risk remains uncertain. Users can require confirmation of the message ID and content scope first.

The visible steps read external email content, but direct the agent only to write it as text into a document; they do not instruct it to run commands, open links, or obey instructions found in the body. Thus, the missing warning alone does not establish that prompt injection would succeed. The risk depends on whether the executing agent interprets retrieved content as instructions, which the source does not specify. Users can ask the author to explicitly treat email bodies as data and forbid acting on embedded instructions or links.