postmark-automation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides standard documentation for integrating with the Postmark API via the Rube MCP. No malicious code, obfuscation, or unauthorized access patterns were detected. All external references trace back to the vendor's infrastructure for the stated tool functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input through email templates and recipient messages, creating a standard surface for indirect prompt injection inherent to communication tools.
- Ingestion points: TemplateModel variables and Messages data processed by the POSTMARK_SEND_BATCH_WITH_TEMPLATES tool as described in SKILL.md.
- Boundary markers: None explicitly defined within the skill instructions.
- Capability inventory: The skill tools can send batch emails, modify templates, and update server settings including webhook URLs.
- Sanitization: No specific sanitization logic is documented within the skill.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to add an external MCP server endpoint (rube.app) to their configuration to enable the toolkit. This is a functional requirement for the skill's purpose.
Audit Metadata