agentmail

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md clearly shows the CLI can fetch and display external emails (e.g., "Read Email" commands like agentmail inboxes:messages retrieve / list threads) — untrusted, user-generated content — and the same skill exposes actions (send/reply/forward) that could be driven by that content, enabling indirect prompt injection.