agentmail-check-email
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill addresses the risk of Indirect Prompt Injection by instructing the agent to treat all email content as untrusted. It includes a specific 'Authorization' section and a matrix defining that content arriving from emails or attachments never authorizes an action on its own.
- [DATA_EXPOSURE]: While the skill processes sensitive email data, it implements safeguards by instructing the agent to minimize the scope of returned data and redact secrets encountered during the search or read process.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by ingesting external data (emails). However, it includes robust mitigations:
- Ingestion points: Data enters through tools like
search_messages,get_thread, andget_attachmentinSKILL.md. - Boundary markers: The 'Untrusted content' section provides clear instructions to ignore instructions embedded in mail to reveal secrets or change rules.
- Capability inventory: The skill allows listing, searching, reading, and updating message labels via the MCP server.
- Sanitization: Explicit instructions to redact secrets and minimize returned data are provided to the agent.
Audit Metadata