portaly-email
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled data for email campaigns (subject, body, and context), creating a potential surface for indirect instructions. This is mitigated by a mandatory human confirmation step.
- Ingestion points: Campaign content and AI context processed in
SKILL.mdandreferences/sending-campaigns.md. - Boundary markers: The instructions explicitly require the agent to read back drafts and wait for human confirmation before sending emails.
- Capability inventory: Uses
vibe_send_campaignto trigger email delivery. - Sanitization: Relies on human review and standard platform-level email sanitization.
- [EXTERNAL_DOWNLOADS]: The skill correctly directs API traffic and redirects to the official vendor domain at
portaly.ai. Neutral documentation of these endpoints is provided for developer integration.
Audit Metadata