agentmail
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configuration requires downloading and running the agentmail-mcp package from npm via npx at runtime.
- [COMMAND_EXECUTION]: The skill sets up an MCP server by executing the npx command, which allows for shell-level tool execution.
- [INDIRECT_PROMPT_INJECTION]: The skill allows the agent to read external emails, creating a surface for indirect prompt injection attacks where malicious instructions could be embedded in incoming messages.
- Ingestion points: The get_thread tool reads external email content into the agent context.
- Boundary markers: There are no instructions to the agent to treat email content as untrusted or to use specific delimiters.
- Capability inventory: The agent has tools to send emails, reply to messages, and create inboxes.
- Sanitization: The documentation does not specify any sanitization or validation of the ingested email data.
Audit Metadata