inbox-executive-assistant
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external email and calendar sources, creating a significant surface for indirect prompt injection attacks.\n
- Ingestion points: The agent is instructed to read email bodies, search attachments, and retrieve calendar event details via Gmail/Outlook and Google Calendar connectors (SKILL.md).\n
- Boundary markers: The skill includes robust "HARD" safety rules that instruct the agent to treat all inbound content as hostile and explicitly ignore instructions found within email bodies, acting as an instructional boundary.\n
- Capability inventory: The skill possesses capabilities to read/search emails, create drafts (draft-only restriction), read/create/update calendar events, and apply labels to threads.\n
- Sanitization: The skill mandates flagging suspicious content to the user and strictly forbids the automatic fetching of links or images embedded in emails to prevent data exfiltration via techniques like EchoLeak.
Audit Metadata