outlook-automation
Warn
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to configure 'https://rube.app/mcp' as a remote MCP server. This allows an external third-party domain to define the tools and logic executed by the AI agent within the user's environment.
- [DATA_EXFILTRATION]: The workflow processes highly sensitive personal and enterprise data, including email content, calendar events, and contacts, via the 'rube.app' domain. This creates a data exposure surface where private communications are handled by a non-verified third-party infrastructure.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting untrusted data from email bodies and attachments. 1. Ingestion points: OUTLOOK_GET_MESSAGE, OUTLOOK_SEARCH_MESSAGES, and OUTLOOK_DOWNLOAD_OUTLOOK_ATTACHMENT. 2. Boundary markers: Absent; there are no instructions to the agent to isolate or treat email content as potentially malicious. 3. Capability inventory: The skill has the ability to read, search, and manage all aspects of a user's Outlook account. 4. Sanitization: No sanitization or validation of the retrieved content is performed.
Audit Metadata