portaly-email

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled data for email campaigns (subject, body, and context), creating a potential surface for indirect instructions. This is mitigated by a mandatory human confirmation step.
  • Ingestion points: Campaign content and AI context processed in SKILL.md and references/sending-campaigns.md.
  • Boundary markers: The instructions explicitly require the agent to read back drafts and wait for human confirmation before sending emails.
  • Capability inventory: Uses vibe_send_campaign to trigger email delivery.
  • Sanitization: Relies on human review and standard platform-level email sanitization.
  • [EXTERNAL_DOWNLOADS]: The skill correctly directs API traffic and redirects to the official vendor domain at portaly.ai. Neutral documentation of these endpoints is provided for developer integration.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 08:43 AM