email-ops
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks as it ingests and processes untrusted data from existing email threads to inform agent actions.
- Ingestion points: Documented in
SKILL.mdunder Workflow Step 2 ("Read the thread before composing"). - Boundary markers: The instructions do not specify the use of delimiters or boundary markers to isolate untrusted thread content from the agent's instructions.
- Capability inventory: The skill has write and execution capabilities, including drafting emails, sending messages through the mail surface (Workflow Step 3), and triaging or archiving mail.
- Sanitization: There is no mention of sanitizing, validating, or filtering the content of ingested email threads before processing.
Audit Metadata