cloudflare-email-routing
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of incoming email messages, creating a surface for indirect prompt injection.
- Ingestion points: Raw email content is ingested via the email handler's message.raw property in src/email.ts and various template files such as templates/receive-basic.ts.
- Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the email content as untrusted data or to ignore instructions embedded within the message body.
- Capability inventory: The skill uses standard capabilities including sending emails via env.SES.send(), forwarding messages via message.forward(), and performing database operations via env.DB as documented in SKILL.md and templates/receive-reply.ts.
- Sanitization: The skill lacks robust sanitization for external content before interpolation; for example, templates/send-notification.ts only performs basic newline-to-BR replacement when generating HTML for the notification body.
Audit Metadata