kelly-email
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted email data from IMAP mailboxes, which creates an inherent surface for indirect prompt injection attacks. \n
- Ingestion points: Untrusted email content is fetched from IMAP servers and parsed in
scripts/generate_review_batch.tsfor classification and draft generation. \n - Boundary markers: The skill strictly follows a 'human-in-the-loop' workflow where all proposed actions must be reviewed and approved in the Kelly Email AirApp before execution, as specified in
SKILL.md. \n - Capability inventory: The skill has capabilities to modify mailbox state via IMAP (move, mark read) and send replies via SMTP in
scripts/execute_ui_decisions.ts. \n - Sanitization: Incoming email content is sanitized using the
sanitizeHtmlEmailutility incontent/kelly-email-app/lib/common.ts, which filters out potentially malicious HTML elements like scripts, forms, and iframes.
Audit Metadata