cloudflare-email-service
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill documents an indirect prompt injection surface where the agent processes external email content in references/routing.md.
- Ingestion points: The email() handler in references/routing.md receives raw email data for processing and storage.
- Boundary markers: Code examples for agent integration do not demonstrate the use of delimiters or explicit instructions to ignore embedded commands in email bodies.
- Capability inventory: The architecture includes network operation capabilities (sending replies via env.EMAIL.send) and data persistence (Durable Objects SQLite).
- Sanitization: No sanitization or validation of the email body content is shown before the data is passed to agent logic or storage.
- [EXTERNAL_DOWNLOADS]: The skill references and fetches resources from well-known and trusted sources, including official Cloudflare documentation, the @cloudflare/workers-types npm package, and Cloudflare's Agents SDK GitHub repository.
- [CREDENTIALS_UNSAFE]: Technical examples for API and CLI usage consistently use secure placeholders such as ${CLOUDFLARE_API_TOKEN} and <API_TOKEN> instead of hardcoded secrets.
- [COMMAND_EXECUTION]: The skill provides numerous commands for the official wrangler CLI to facilitate environment setup and service management.
Audit Metadata