email-quality-auditor
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (DNS headers, ESP exports, CRM truth sets) to perform its audit. While this presents an ingestion surface, the risk is mitigated by explicit boundary markers, a structured 20-item scoring framework, and a requirement for human review of results before any persistence or action.
- Ingestion points: Processes DNS data, email headers, engagement exports, and CRM truth sets via
SKILL.mdinstructions. - Boundary markers: The skill uses a typed conversation header and orthogonal status/verdict fields to separate evidence from analysis.
- Capability inventory: Limited to
WebFetchfor evidence retrieval and file writes to specific memory paths for audit persistence. - Sanitization: Requires evidence reconciliation and validation against a schema (
validate-audit-artifact.py) before persistence. - [COMMAND_EXECUTION]: The skill instructions include a dynamic context resolution step using shell commands to identify the skill root directory.
- Evidence:
AARON_SKILLS_ROOT="${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2/dev/null || true)}"inSKILL.md. - Analysis: This is a standard environment resolution pattern for local repository structures and does not involve untrusted user input or remote execution.
Audit Metadata