outlook-email
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and process untrusted data from external email messages, which could potentially contain instructions aimed at influencing the agent's behavior. While this is a common characteristic of mail-processing tools, it warrants awareness.
- Ingestion Points: External data enters the agent context through tools such as
list_messages,search_messages,fetch_message, andfetch_attachmentas described inSKILL.md. - Boundary Markers: The instructions include guidelines to "keep the response grounded in the actual thread" and explicitly require the agent to separate mailbox analysis from actions. However, there are no specific technical delimiters mentioned for the raw content itself.
- Capability Inventory: The skill possesses significant capabilities, including
send_email,schedule_email,move_email,delete_email, and various mailbox configuration changes as listed inSKILL.md. - Sanitization & Mitigations: The skill implements strong mitigations by enforcing plain-text-only email bodies for all write operations, which prevents the injection of malicious HTML, tracking pixels, or scripts. Additionally, it mandates human-in-the-loop confirmation before any send, schedule, or destructive action occurs.
Audit Metadata