agentmail-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill configures the agent to fetch tool definitions and schemas dynamically from a hosted remote server (https://mcp.agentmail.to/mcp). This creates a surface for indirect prompt injection if the remote server were compromised.
- Ingestion points: Hosted runtime at mcp.agentmail.to/mcp (SKILL.md).
- Boundary markers: None specified for the tool schema ingestion.
- Capability inventory: Includes list_inboxes, list_apps, get_app, connect_app, authorize_inbox, list_accounts, agent_attach_human, and agent_verify, alongside mail management tools (SKILL.md).
- Sanitization: No specific sanitization or validation of the remote schema content is described.
- [EXTERNAL_DOWNLOADS]: The skill mentions external dependencies and repositories maintained by the vendor.
- References tool metadata and configuration in the official agentmail-to GitHub repository.
- Mentions agentmail-mcp packages available on the npm and PyPI registries for stdio-based clients.
- [COMMAND_EXECUTION]: Provides instructions for installing the MCP server using the
claude mcp addcommand, which configures the agent to interact with a remote HTTP transport.
Audit Metadata