kelly-email
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted natural language data from IMAP mailboxes, which constitutes an inherent indirect prompt injection surface common to all email-processing agents.
- Ingestion points: Message subjects and bodies are fetched by
scripts/generate_review_batch.tsand analyzed for classification and drafting. - Boundary markers: The skill's architecture enforces an 'AirApp-first' workflow defined in
SKILL.md, ensuring no mailbox mutation (archive, delete, or send) occurs without materialized human decisions. The review interface uses sandboxed iframes to isolate email content. - Capability inventory: The skill possesses email sending (SMTP) and mailbox management (IMAP) capabilities, but these are restricted to executing only human-validated records retrieved from the Busabase review base.
- Sanitization: The system implements robust HTML sanitization in
app/lib/common.tsvia thesanitizeHtmlEmailfunction, which filters out scripts, event handlers, forms, and other potentially malicious elements from incoming mail content.
Audit Metadata