inbox-triage
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it ingests untrusted incoming emails from external senders and uses that data to drive automation.
- Ingestion points: Untrusted external email data (sender information, subject, text snippets, and full message threads) enters the agent context via Gmail/Outlook MCP tools during Step 2 and Step 3 in
SKILL.md. - Boundary markers: Absent. The instructions lack explicit text delimiters or warnings telling the model to ignore instructions embedded within the bodies of the analyzed emails.
- Capability inventory: The skill possesses the capability to execute web searches for sender research, generate email drafts via email tools, and perform file read/write/append operations on files like
blocklist.mdandtracker.mdviascripts/kb_reader.pyandSKILL.md. - Sanitization: Absent. There is no evidence of pre-processing, escaping, or structural filtering applied to the incoming email bodies to strip potential adversarial prompt injection text before the agent evaluates it.
Audit Metadata