inbound-triage
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from email and messaging platforms, which is a known vector for indirect prompt injection attacks.
- Ingestion points: The skill reads thread context, subjects, and notifications from mixed email, LinkedIn, or messaging inboxes (SKILL.md).
- Boundary markers: The instructions lack specific delimiters or explicit warnings for the agent to ignore instructions that might be embedded within the content of the processed messages.
- Capability inventory: The skill is intended to help decide on actions like replying, delegating, or changing read states. Although it instructs the agent not to execute these actions without further user instruction, the underlying agent environment typically provides the tools to perform these operations, which could be triggered by a successful injection.
- Sanitization: There is no evidence of sanitization, escaping, or filtering applied to the incoming message data before it is processed by the agent.
Audit Metadata