email-management-expert

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow can ingest outsider-authored email body text via Apple Mail MCP tools like get_email_with_content() / get_email_thread() / search_emails(include_content=True), which read arbitrary message content from other senders into the agent’s LLM context (indirect prompt injection risk).