Email Intelligence Engineer
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process raw email data from external sources, which is then used to construct context for an AI agent. This creates a surface for indirect prompt injection where malicious instructions embedded in an email could influence the agent's behavior.
- Ingestion points: The
fetch_threadfunction inSKILL.mdfetches raw RFC822 email data via IMAP or APIs. - Boundary markers: The skill uses structured JSON and citations to organize context, but the instructions do not include explicit prompt delimiters or 'ignore' instructions for the agent when processing the resulting context blocks.
- Capability inventory: The skill provides tool interfaces (
email_ask,email_search) that expose the processed email data to broader agent frameworks like LangChain or CrewAI, potentially allowing injected instructions to reach execution-capable tools. - Sanitization: The skill implements several defensive layers including character encoding normalization, HTML-to-text conversion, and a PII detection/redaction pipeline.
Audit Metadata