email-writer
Warn
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill implements a 'Retry Loop' (Step 5 in
SKILL.md) that explicitly instructs the agent to modify its own source file (SKILL.md) and configuration files in the.agents/voice-profiles/directory. This mechanism translates user-provided text (pasted emails) into permanent behavioral rules, which can be exploited to persistently inject malicious instructions into the agent's core logic. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill is instructed to read external, potentially untrusted data including email history, CRM records, and call transcripts (
SKILL.md, Step 2). It also ingests user-provided 'final versions' of emails in the Retry Loop. - Boundary markers: The instructions lack any requirement for delimiters or 'ignore' instructions when processing these external data sources.
- Capability inventory: The skill has the capability to read from and write to the filesystem, including its own instruction sets and the
.agents/configuration directory. - Sanitization: There is no mention of sanitizing, validating, or escaping the content retrieved from transcripts or emails before it is used to inform or update the agent's behavior.
- [DATA_EXFILTRATION]: The skill requires access to highly sensitive business information, including CRM data (pricing, stakeholders, deal stages), full email histories, and meeting transcripts. While no explicit network exfiltration tools are defined in the frontmatter, the broad access to PII and proprietary business data constitutes a significant exposure risk if the agent's context is compromised.
Audit Metadata