spark-recipe-shared-inbox-triage
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted email content from external senders, creating an attack surface for indirect prompt injection.
- Ingestion points: The
spark thread <id>command inSKILL.mdallows the agent to ingest full conversation history from external emails into its context. - Boundary markers: Absent. The instructions do not define specific delimiters or warn the agent to ignore instructions embedded within the email text.
- Capability inventory: The skill includes the ability to perform actions such as
spark draft(replying to emails),spark action assign(modifying item ownership), andspark comment(adding internal notes) as shown inSKILL.md. - Sanitization: Absent. The workflow does not specify any validation or sanitization of the email data before it is processed or acted upon by the agent.
- [COMMAND_EXECUTION]: The skill utilizes the
sparkCLI tool to perform inbox management tasks. These commands are consistent with the skill's primary purpose and represent the intended use of the vendor's toolset.
Audit Metadata