email-for-ai-agents
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill addresses the vulnerability surface where agents process untrusted data from inbound emails. It provides a detailed mitigation strategy for handling content that may contain malicious instructions.\n
- Ingestion points: Inbound email messages, attachments, and webhook payloads as identified in
SKILL.mdandreferences/threat-model.md.\n - Boundary markers: The documentation recommends using triple-dash delimiters (
---) and instructional framing to separate data from instructions in LLM prompts.\n - Capability inventory: The skill describes tools for inbox management (
client.inboxes.create), message retrieval (messages.list,messages.get), and communication (messages.send,messages.reply,drafts.create).\n - Sanitization: It provides regex patterns for scanning outbound content for secrets and advocates for signature verification of incoming webhooks.\n- [SAFE]: The instructions and code snippets in
references/threat-model.mdandSKILL.mdserve as defensive examples, such as implementing allow lists for senders and verifying signatures using thesvixlibrary to prevent spoofing.\n- [SAFE]: Instances of prompt injection patterns identified by static analysis (e.g., "Ignore your previous instructions") are contained within a reference threat model as examples of attacks to defend against, rather than functional injections.
Audit Metadata