inbox-manager
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and process untrusted external data in the form of emails. To manage risks associated with embedded instructions, the skill implements a policy of treating email content as data rather than commands.
- Ingestion points: Data enters the agent context through the Read tool (accessing Gmail or Microsoft 365) and user-supplied text (pasted or forwarded emails), as defined in SKILL.md and reference/handoffs.md.
- Boundary markers: The skill includes instructions to disregard instructions found within processed text and establishes a 'data vs command' boundary in SKILL.md (Step 3) and reference/gotchas.md.
- Capability inventory: The skill can draft replies, file messages, and hand off tasks to other specialized skills.
- Sanitization and Gates: A human-in-the-loop requirement is enforced for all outgoing messages (Step 6), and sensitive requests like bank detail changes require manual verification, as noted in reference/gotchas.md.
- Anti-Phishing and Fraud Prevention: The instructions include a 'character by character' verification step for sending domains when processing sensitive requests. This pattern serves as a defense against homoglyph-based phishing where lookalike characters are used to impersonate trusted senders.
- Data Integrity and Access Control: The skill operates within existing user taxonomies (labels/folders) and adheres to a policy of 'archive, never delete,' ensuring data remains searchable and preventing unintended removal of information.
Audit Metadata