triage-inbox
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Gmail threads and Google Calendar events, creating a surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context via the Gmail and Google Calendar MCP search and read tools (referenced in SKILL.md, Phase 1).
- Boundary markers: The skill does not define specific delimiters or "ignore instructions" markers to isolate the classification logic from instructions potentially embedded in email bodies.
- Capability inventory: The skill possesses
WriteandBashtools, and is capable of staging Gmail drafts via the MCP interface (SKILL.md, Phase 2). - Sanitization: The instructions do not specify any sanitization, escaping, or filtering of email content before it is processed to extract "gists" and classification buckets.
- [DATA_EXFILTRATION]: The skill fetches private communication data through external APIs and writes extracted summaries to the local filesystem.
- Evidence: The skill creates persistent dated reports in
quality_reports/inbox/containing email gists, senders, and deadlines (SKILL.md, Phase 3). If the repository is shared, committed to a public version control system, or uploaded, these private details would be exposed.
Audit Metadata