mermail-gtm-agent
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from inbound emails and Apollo lead records, creating an attack surface for indirect prompt injection where malicious instructions could be hidden in processed content.\n
- Ingestion points: External data is retrieved via
list_emails,get_email, andexecute_composio_tool(Apollo search).\n - Boundary markers: The skill instructions and
references/security.mdexplicitly direct the agent to treat these sources as untrusted data rather than instructions.\n - Capability inventory: The skill possesses the ability to send emails and create automated triagers, which are sensitive capabilities if manipulated.\n
- Sanitization: Mitigation measures include mandatory character limits (10,000 chars), requiring a
cleanscan status for email bodies, and enforcing human approval for all outgoing communications.\n- [EXTERNAL_DOWNLOADS]: The skill connects to an external Model Context Protocol (MCP) server athttps://console.mermail.app/mcpto access mailbox and automation tools. This endpoint is hosted on the official domain of the Mermail service.
Audit Metadata