agent-mail

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In Agent Mail coordination mode, the required runtime workflow uses tool calls like fetch_inbox(... include_bodies=true ...)/summarize_thread(...) to ingest message/thread free text that other (outsider) tenants/users can author and post into the same project/thread.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly includes an "Admin / disaster-recovery mode" that can install components and perform destructive operations (e.g., backup/restore and an irreversible "clear-and-reset-everything" that deletes the database and all storage), which instructs the agent to modify or destroy machine state and therefore must be flagged.