initiate-inboxmate-knowledge
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents a pipeline that involves ingesting and processing untrusted data from external web sources.
- Ingestion points: The workflow includes scraping external websites via tools like
scrape_and_build_knowledgeandWebFetch(referenced in Gotcha 8) to populate knowledge buckets. - Boundary markers: There are no instructions provided to the agent regarding the use of delimiters or specific warnings to ignore instructions that might be embedded within the scraped web content.
- Capability inventory: The skill describes a highly capable environment where the agent can execute SQL queries on a Supabase database (
mcp__plugin_supabase_supabase__execute_sql), create and modify email drafts, and interact with various internal APIs (CRM, Notification Service). - Sanitization: While the skill includes basic filtering for "junk URLs" (e.g., /wp-json/, /favicon.ico) and 404 detection, it lacks robust sanitization or validation mechanisms to prevent malicious instructions in the scraped data from influencing the agent's downstream actions, such as email generation or database operations.
Audit Metadata