setup-email-drafts
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill performs outreach personalization by fetching and reading content from company websites (Step 4c). This creates an attack surface where untrusted data from a website could include instructions designed to influence the agent's task or generate malicious output.\n
- Ingestion points: External company websites are fetched to provide context for personalized email writing in Step 4c.\n
- Boundary markers: The instructions do not mandate the use of delimiters or warnings to ignore embedded instructions when processing web content.\n
- Capability inventory: The agent has the ability to read local files, execute shell commands (via curl and python), and create or modify email drafts and CRM tasks.\n
- Sanitization: No specific sanitization or escaping mechanisms are described for the data retrieved from external URLs before it is used for prompt construction.\n- [COMMAND_EXECUTION]: The skill relies on shell command execution for its primary operations, including numerous
curlrequests to interact with API endpoints and apython3one-liner used to parse JSON data and extract draft counts in Step 5a.\n- [CREDENTIALS_UNSAFE]: The skill requires access to sensitive API tokens (PSQUARED_CRM_TOKENandEMAIL_DRAFT_ONLY_BEARER) stored in a.envfile. Although the skill correctly recommends reading the file directly to avoid shell injection associated with thesourcecommand, sensitive credentials are still handled as variables within shell command strings.
Audit Metadata