zynkr-support
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of processing untrusted external data.
- Ingestion points: Untrusted data enters the agent context through Gmail message bodies and thread content retrieved via the
google-workspaceMCP server inSKILL.md(Step 2). - Boundary markers: The skill lacks explicit boundary markers or delimiters (e.g., XML tags or distinct markers) to separate incoming email content from instructional prompts. While it uses
[[NEEDS PETER]]blocks for draft labeling, these do not isolate the input data during analysis. - Capability inventory: The skill possesses significant capabilities, including reading full email threads and creating new email drafts (
mcp__google-workspace__draft_gmail_message), which could be abused if an attacker sends a malicious payload via email. - Sanitization: There is no evidence of sanitization, filtering, or instruction-override protection applied to the content parsed from the Gmail threads.
Audit Metadata