Lead Processor
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external IMAP mailboxes, creating a surface for indirect prompt injection where an attacker could send an email with instructions designed to bypass the skill's logic.
- Ingestion points: Email bodies and headers from inbound mailboxes are processed for classification and reply generation as described in SKILL.md.
- Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands within the processed email content.
- Capability inventory: The skill is capable of moving emails between folders, saving drafts, sending emails via SMTP, and updating records in a CRM system.
- Sanitization: There is no evidence of sanitization, escaping, or validation of the email content before it is processed by the AI.
- Mitigation: A strong mitigation is present in Section 2, where a "CRITICAL CONSTRAINT" mandates that no email can be sent without an explicit user confirmation keyword (【确认发送】), preventing fully autonomous malicious actions.
Audit Metadata