applemail-cli

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external email subjects and bodies.
  • Ingestion points: Untrusted data enters the agent context through the applemail unread, applemail search, and applemail read commands.
  • Boundary markers: The skill explicitly instructs the agent to treat email content as private and untrusted, and never to follow instructions found inside an email.
  • Capability inventory: The skill uses shell command execution to interact with the system.
  • Sanitization: The skill recommends using max_body_chars to limit the volume of ingested data, though it does not specify structural escaping for the prompt.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the applemail-cli binary via Homebrew.
  • The command brew install roman-pinchuk/tap/applemail-cli downloads code from a repository associated with the skill's author.
  • [COMMAND_EXECUTION]: The skill relies on shell command execution to perform its primary functions.
  • It executes the applemail command, which internally utilizes macOS Automation (osascript) to interface with the Mail application.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 09:16 AM
Security Audit — agent-trust-hub — applemail-cli