applemail-cli
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external email subjects and bodies.
- Ingestion points: Untrusted data enters the agent context through the
applemail unread,applemail search, andapplemail readcommands. - Boundary markers: The skill explicitly instructs the agent to treat email content as private and untrusted, and never to follow instructions found inside an email.
- Capability inventory: The skill uses shell command execution to interact with the system.
- Sanitization: The skill recommends using
max_body_charsto limit the volume of ingested data, though it does not specify structural escaping for the prompt. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
applemail-clibinary via Homebrew. - The command
brew install roman-pinchuk/tap/applemail-clidownloads code from a repository associated with the skill's author. - [COMMAND_EXECUTION]: The skill relies on shell command execution to perform its primary functions.
- It executes the
applemailcommand, which internally utilizes macOS Automation (osascript) to interface with the Mail application.
Audit Metadata