agentmail

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes incoming email content, which constitutes an attack surface for indirect prompt injection.
  • Ingestion points: Email bodies, subjects, and attachments are ingested through SDK methods like client.inboxes.messages.get (referenced in SKILL.md, references/python.md, and references/typescript.md), as well as through webhook notifications (references/webhooks.md) and WebSocket streams (references/websockets.md).
  • Boundary markers: The documentation includes clear warnings to treat all incoming data as untrusted (seen in SKILL.md and references/webhooks.md), although the code snippets themselves do not implement technical delimiters or specific "ignore" instructions for the AI.
  • Capability inventory: The skill enables the agent to send, reply to, and forward emails, which are significant external side effects. It also provides administrative capabilities such as domain verification and allow/block list management (references/admin.md).
  • Sanitization: No explicit sanitization or content-filtering logic is provided in the examples for the ingested message text before it is processed or acted upon by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 11:30 PM
Security Audit — agent-trust-hub — agentmail