cowork-inbox-triage
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection due to its reliance on untrusted external inputs.
- Ingestion points: The skill explicitly pulls unread and flagged email threads from external accounts (Gmail or Microsoft 365) to classify them and draft replies (SKILL.md).
- Boundary markers: The instructions lack boundary markers or system-level directives to ignore instructions that might be embedded within the body of incoming emails.
- Capability inventory: The skill has access to tools for reading and writing emails, performing web searches, and executing shell commands (Bash).
- Sanitization: No sanitization or validation logic is defined to prevent the AI from following malicious instructions contained within processed emails.
- Autonomous Risk: The 'Scheduled Mode' facilitates unattended execution in a cloud session, which removes human-in-the-loop oversight and increases the likelihood of a successful injection attack influencing automated actions.
Audit Metadata