mermail-agent-inbox
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted inbound email content, creating a surface for indirect prompt injection. It mitigates this risk through a multi-layered defense strategy:
- Ingestion points: External email data is ingested via MCP tools like
get_emailandsearch_emails(SKILL.md, references/tools.md). - Boundary markers: The skill mandates metadata-only reads for candidate selection to prevent the model from processing potentially malicious bodies prematurely. It also uses explicit instructions to treat all message content as untrusted (references/security.md).
- Capability inventory: Capabilities are restricted to mailbox management tools; it lacks direct shell or browser access for untrusted content.
- Sanitization: Instructions require stripping HTML, ANSI/OSC sequences, and bidirectional control characters, while limiting text processing to 10,000 characters (SKILL.md, references/security.md).
- [COMMAND_EXECUTION]: The skill provides documentation for using the
mermailCLI tool to perform mailbox operations. These commands are specific to the Mermail service and are intended for authorized administrative tasks (references/tools.md).
Audit Metadata