customer-email-draft-threads
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external, untrusted sources (Gmail messages), which creates a potential surface for indirect prompt injection attacks where malicious instructions are hidden in email content.
- Ingestion points: Incoming Gmail messages (bodies, links, attachments, and headers) are read in
SKILL.md(Step 2) andreferences/runbook.md. - Boundary markers: Both
SKILL.md(Step 1) andreferences/runbook.md(Gmail Safety Contract) explicitly instruct the agent to treat all email content as untrusted and to ignore instructions embedded within messages that attempt to override the automation's rules. - Capability inventory: The skill possesses several high-impact capabilities including creating Gmail drafts (
SKILL.mdStep 4), creating Codex project threads (SKILL.mdStep 5), updating memory, and committing file changes to a repository. - Sanitization: The
references/runbook.mdincludes a Classification Guide that mandates manual review for security alerts, payment requests, and suspected phishing, providing a layer of human-in-the-loop validation.
Audit Metadata