messages-ops
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from messaging platforms (iMessage, X DMs, etc.). This creates a surface for indirect prompt injection where malicious instructions embedded in a message could attempt to influence the agent's behavior during thread inspection or retrieval.
- Ingestion points: Workflow steps for reading inbound messages and searching local message windows for codes (SKILL.md).
- Boundary markers: None explicitly defined to separate message content from agent instructions.
- Capability inventory: The workflow implies capabilities for reading local messages, accessing social media DMs, and potentially handing off tasks to other skills like
email-ops. - Sanitization: No specific sanitization or filtering of message content is mentioned before the agent processes or reports on the data.
Audit Metadata