agentmail
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a platform-specific binary from the official AgentMail GitHub releases during package installation (
npm/scripts/postinstall.js). - [COMMAND_EXECUTION]: Instructs the agent to install and execute a CLI tool (
agentmail-cli) and executes a binary wrapper (npm/bin/agentmail) usingexecFileSyncto run the downloaded AgentMail core logic. - [PROMPT_INJECTION]: The CLI tool includes a feature (
pkg/cmd/flagoptions.go) that allows reading arbitrary local files and including their contents in API requests (as body or attachments) by prefixing a parameter value with the@character. This creates a surface for indirect prompt injection where a malicious actor could trick the agent into exfiltrating sensitive local files (e.g., SSH keys, credentials) via email. - Ingestion points: Agent instructions or user-provided data processed by the agent in
SKILL.md. - Boundary markers: Absent.
- Capability inventory: The
agentmailtool has the capability to read filesystem contents and transmit data via network requests to the AgentMail API. - Sanitization: Absent; the tool treats any string starting with
@as a potential file path to be read without further validation.
Audit Metadata