email-ops
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted content from email mailboxes (inbox triage, reading threads). This creates a vulnerability surface where malicious instructions embedded in incoming emails could influence the agent's behavior during triage or drafting.
- Ingestion points: Incoming messages and existing email threads in the mailbox (referenced in Workflow Step 2).
- Boundary markers: The skill does not provide specific delimiters or instructions for the agent to ignore or isolate embedded commands found within the email body text.
- Capability inventory: The skill authorizes the agent to triage (archive/archive low-signal mail), draft, and perform live sends of emails (Workflow Steps 1, 3, and 4).
- Sanitization: The skill lacks mentions of sanitization, filtering, or escaping of external email content before it is interpolated into the agent's context.
Audit Metadata