email-ops
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from incoming email threads and mailbox contents, which creates a vulnerability surface for indirect prompt injection attacks where malicious instructions in an email could attempt to hijack the agent's behavior.
- Ingestion points: The workflow involves reading existing threads and triaging inbox contents to identify commitments or questions (SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' markers to separate untrusted email content from the agent's primary system instructions.
- Capability inventory: The skill allows the agent to archive messages, draft replies, and execute live sends, providing significant interaction capabilities with the user's mail surface.
- Sanitization: No explicit instructions are provided for the agent to sanitize, escape, or validate content ingested from external emails before processing it.
Audit Metadata