email-triage
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process the contents of emails, which serves as an untrusted input vector.
- Ingestion points: The agent reads email bodies and message previews via the
joelclaw email readcommand as defined inSKILL.md. - Boundary markers: The instructions lack explicit boundary markers or directives for the agent to ignore or isolate potential instructions embedded within the email text.
- Capability inventory: The skill provides the agent with capabilities to archive emails (individually or in bulk) and draft replies, creating a path for malicious email content to influence system state or communications.
- Sanitization: No sanitization or validation logic is specified to filter the email content before it is interpolated into the agent's reasoning process.
Audit Metadata