agentmail
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes incoming email content, which constitutes an attack surface for indirect prompt injection.
- Ingestion points: Email bodies, subjects, and attachments are ingested through SDK methods like
client.inboxes.messages.get(referenced inSKILL.md,references/python.md, andreferences/typescript.md), as well as through webhook notifications (references/webhooks.md) and WebSocket streams (references/websockets.md). - Boundary markers: The documentation includes clear warnings to treat all incoming data as untrusted (seen in
SKILL.mdandreferences/webhooks.md), although the code snippets themselves do not implement technical delimiters or specific "ignore" instructions for the AI. - Capability inventory: The skill enables the agent to send, reply to, and forward emails, which are significant external side effects. It also provides administrative capabilities such as domain verification and allow/block list management (
references/admin.md). - Sanitization: No explicit sanitization or content-filtering logic is provided in the examples for the ingested message text before it is processed or acted upon by the agent.
Audit Metadata