mermail-compose-email
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as email bodies, quoted history, and attachments, which serves as an attack surface for indirect prompt injection.
- Ingestion points: The agent ingests data from selected emails and thread history during the composition and reply workflows.
- Boundary markers: The instructions in SKILL.md and references/security.md explicitly command the agent to treat source content as reference data and disregard any instructions or commands embedded within.
- Capability inventory: The skill utilizes tools like send_email, reply_to_email, and forward_email to perform external communication.
- Sanitization: Security protocols require explicit human-in-the-loop approval for all delivery payloads and prohibit automatic retries for ambiguous responses.
- [EXTERNAL_DOWNLOADS]: The skill configuration defines a connection to an external MCP server to perform its primary functions.
- Evidence: The configuration in agents/openai.yaml points to https://console.mermail.app/mcp, which is the official infrastructure for the Mermail service associated with the skill author.
Audit Metadata