agentmail-check-email
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill inherently processes untrusted data arriving from email subjects, bodies, and attachments.
- Ingestion points: Untrusted data enters the agent's context through tools like
search_messages,search_threads,get_thread, andget_attachmentas described in the Read workflow inSKILL.md. - Boundary markers: The skill includes an explicit 'Untrusted content' section and an 'Authorization' matrix that instructs the agent to treat subjects, bodies, headers, and links as untrusted and to never follow instructions embedded in mail to reveal secrets or change rules.
- Capability inventory: The skill has the capability to modify message metadata (
update_message) and read attachment content (get_attachment). - Sanitization: The instructions mandate scope minimization for returned data and explicit user authorization for any consequential actions, preventing the agent from autonomously executing instructions found in email content.
Audit Metadata