follow-up-chaser
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from inbound email subjects, bodies, and attachments, creating a potential attack surface for indirect prompt injection.
- Ingestion points: Email content accessed via Gmail or Microsoft 365 connectors.
- Boundary markers: The instructions include a specific safety rule (Rule 2) directing the agent to ignore instructions found within email threads and treat all email content as hostile.
- Capability inventory: The skill's capabilities are limited to reading email/calendar data and creating drafts; it possesses no shell execution or network outbound capabilities (other than the platform-managed connectors).
- Sanitization: The skill enforces a human-in-the-loop requirement, where all generated content is saved as a draft for user review rather than being sent automatically.
- [DATA_EXFILTRATION]: The skill explicitly mitigates known exfiltration vectors like EchoLeak by prohibiting the automatic fetching of links or images found within email threads.
Audit Metadata