mailcoach
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute the
mailcoachCLI binary to perform management tasks on email lists, subscribers, and campaigns.\n - Evidence: The skill body and associated rules provide numerous examples of CLI usage, such as
mailcoach create-campaignandmailcoach list-subscribers.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from external Mailcoach instances, creating a vulnerability surface where malicious instructions could be ingested by the agent.\n - Ingestion points: Data enters the context via CLI outputs from commands that retrieve campaign content, subscriber details, or template definitions (e.g.,
mailcoach show-campaign --json).\n - Boundary markers: The instructions do not specify any delimiters or ignore-instructions for the agent when handling data returned by the API.\n
- Capability inventory: The skill can execute shell commands and read local files for upload (e.g., using the
--field key=@pathsyntax), which could be exploited if the agent follows instructions embedded in external data.\n - Sanitization: There is no evidence of sanitization or validation of the retrieved data before it is interpreted by the agent.
Audit Metadata