email-triage

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt requires fetching and outputting email bodies (up to 500 words) and composing reply text from them without any enforced redaction, which can expose API keys, passwords, or other secrets present verbatim in emails.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The skill’s runtime path reads Gmail email bodies (including first 500 words) from the user’s inbox via the Gmail connector, and those email contents are outsider-authored free text from other people, which the agent then ingests into the LLM context for classification and “What they need” extraction.