extension-email-calendar-events
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill accepts user-supplied text for event summaries, descriptions, and locations, which are then used to generate email invitations. The processing of untrusted data without explicit sanitization or boundary markers creates a surface for indirect prompt injection. 1. Ingestion points: registerUser, addCalendarEvent, and updateEventDetails functions in src/backend/main.mo. 2. Boundary markers: Absent. 3. Capability inventory: Network operation via EmailClient.sendCalendarEvent. 4. Sanitization: No sanitization of input text fields is performed in the provided actor implementation.
- [SAFE]: All external module references, including caffeineai-email-calendar-events, caffeineai-authorization, and caffeineai-email, are vendor-specific resources originating from the skill author caffeinelabs.
Audit Metadata