inbox-triage
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's email inbox, including unread emails, historical communications, and attachments (contracts, decks, spreadsheets) to classify content and draft replies.
- Ingestion points: Email bodies and attachments are read by the agent to perform classification and drafting tasks.
- Boundary markers: The instructions do not specify the use of delimiters (like XML tags or triple quotes) or provide 'ignore embedded instructions' warnings when the agent processes external email content.
- Capability inventory: The skill has access to sensitive capabilities including reading/writing Gmail (creating drafts), writing local files (HTML reports and configuration files), and sending notifications to Slack.
- Sanitization: There are no directives to sanitize, escape, or validate external content before it is interpolated into drafts or HTML reports, potentially allowing an attacker to influence the agent's behavior via a malicious email.
Audit Metadata