refine-email-drafts
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and "literally" follows natural language instructions from a
change_requestfield retrieved via an external API, which creates a significant surface for indirect prompt injection if the source data is manipulated.\n - Ingestion points: Natural language instructions are ingested from the
notifications.psquared.dev/draftsAPI, as detailed inSKILL.md.\n - Boundary markers: The skill instructions provide no delimiters or warnings to isolate the untrusted
change_requestcontent from the agent's core instructions.\n - Capability inventory: The agent has network capabilities via
curland access to authentication tokens from the environment (.env) to read and update draft data.\n - Sanitization: There is no evidence of validation, filtering, or sanitization of the externally sourced natural language instructions before they are processed by the agent.\n- [COMMAND_EXECUTION]: The skill relies on
curlcommands to interact with thenotifications.psquared.devAPI service.\n - Evidence:
SKILL.md(Step 1 and Step 2d) contains shell commands for GET and PUT requests to the vendor's infrastructure using an authentication token.\n - Context: These network operations are intrinsic to the skill's primary functionality and target domains associated with the skill's developer.
Audit Metadata