listener-creator
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates untrusted email content (subject and body) directly into prompts for the
callAgentmethod (e.g., inai-classifier.tsandurgent-watcher.ts). \n - Ingestion points: Untrusted data enters via the
Emailobject fields (email.subject,email.body).\n - Boundary markers: No delimiters (like XML tags) or instructions to ignore embedded commands are present to separate the email content from the system instructions.\n
- Capability inventory: The skill can archive, star, label emails, and send high-priority notifications, all of which could be manipulated by a malicious email.\n
- Sanitization: The skill only performs basic string truncation on the email body, providing no protection against adversarial content.\n- [COMMAND_EXECUTION]: The skill's primary function is to generate and write TypeScript source code to the
agent/custom_scripts/listeners/directory. These files are then dynamically loaded and executed by the platform to monitor email events, representing a local code execution surface.
Audit Metadata