reply-debt
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from inbound emails that is subsequently included in a summary brief for the AI agent. An external sender could potentially embed malicious instructions in an email subject or snippet to influence the agent's behavior when it processes the brief.
- Ingestion points: Untrusted message metadata is fetched via
GmailApiBackend.searchandComposioBackend.searchinscripts/reply_debt.py. - Boundary markers: The
render_brieffunction lacks specific delimiters or instructional framing to isolate untrusted email content from the agent's primary instructions. - Capability inventory: The skill is capable of sending emails via the Gmail API and writing local files, which could be abused if the agent is successfully injected.
- Sanitization: The skill performs no sanitization or escaping of the email content before rendering it into the markdown brief.
Audit Metadata