mermail-automate-triage
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes inbound email content, including subjects, bodies, and attachments, which are untrusted data sources.
- Ingestion points: Inbound email data processed by the triage automation (defined in SKILL.md and references/security.md).
- Boundary markers: The instructions mandate "bounded sanitized content" and specific intake constraints to isolate instructions from data.
- Capability inventory: Includes creating, updating, and deleting triagers, and opening linked agent conversations via MCP tools.
- Sanitization: references/security.md requires stripping active HTML, ANSI/OSC escapes, bidirectional controls, and nonessential control characters.
- [EXTERNAL_DOWNLOADS]: The skill connects to a remote Model Context Protocol (MCP) server to perform its operations.
- Source: Connects to the service endpoint at https://console.mermail.app/mcp as defined in agents/openai.yaml.
Audit Metadata