cloudflare-email-routing

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of incoming email messages, creating a surface for indirect prompt injection.
  • Ingestion points: Raw email content is ingested via the email handler's message.raw property in src/email.ts and various template files such as templates/receive-basic.ts.
  • Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the email content as untrusted data or to ignore instructions embedded within the message body.
  • Capability inventory: The skill uses standard capabilities including sending emails via env.SES.send(), forwarding messages via message.forward(), and performing database operations via env.DB as documented in SKILL.md and templates/receive-reply.ts.
  • Sanitization: The skill lacks robust sanitization for external content before interpolation; for example, templates/send-notification.ts only performs basic newline-to-BR replacement when generating HTML for the notification body.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:00 AM
Security Audit — agent-trust-hub — cloudflare-email-routing