superhuman-mail

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s workflow explicitly uses the Superhuman Mail MCP server to “list and fetch email threads and messages” and “get attachments and read statuses,” which at runtime will ingest email body text authored by other people (outsider senders/recipients) into the agent’s LLM context via the MCP tool responses.