action-mailer
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: Provides comprehensive and secure instructions for configuring Rails Action Mailer, emphasizing best practices such as parameterized mailers and absolute URLs.\n- [SAFE]: Suggests standard, well-established gems like letter_opener and premailer-rails for development and production workflows.\n- [SAFE]: Uses Rails credentials for SMTP secret management, preventing hardcoded credentials.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a standard surface for indirect prompt injection by processing external data via parameters for email template interpolation.\n
- Ingestion points: Data enters the mailer via the .with(params) method and is accessed inside mailer actions (e.g., app/mailers/user_mailer.rb).\n
- Boundary markers: None explicitly defined in the templates to differentiate between data and instructions beyond standard HTML tags.\n
- Capability inventory: The skill uses Bash for Rails generation and testing, along with Write, Edit, and Read tools for file manipulation.\n
- Sanitization: The skill utilizes Rails ERB templates which automatically escape HTML content, providing a significant layer of protection against traditional injection attacks.
Audit Metadata