bx-mail
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a set of capabilities for sending emails and reading local files for attachments, which represents a potential surface for indirect prompt injection if the agent processes untrusted data.
- Ingestion points: The agent may ingest untrusted data from user prompts or external files (e.g., SKILL.md in the current working directory) to construct email bodies, subjects, or attachment paths.
- Boundary markers: The provided examples do not include boundary markers or instructions to ignore embedded commands within the email content.
- Capability inventory: The skill enables network communication via SMTP and file system access for attachments using the
bx:mailparamcomponent. - Sanitization: There are no explicit instructions or code patterns for sanitizing or validating external content before it is interpolated into the email sending components.
Audit Metadata