important-email-digest
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The protocol includes a scheduled task instruction that uses the override keyword 'IGNORE' to modify its execution logic ('IGNORE step 4 and step 5'). While likely intended for flow control, this pattern uses terminology associated with prompt overrides.
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it ingests untrusted data from Gmail emails and possesses capabilities to send SMS messages and create scheduled tasks. An attacker could send an email with instructions that the agent might follow while processing the content.
- Ingestion points: Untrusted data enters the agent context via the 'gmail-find-email' action in SKILL.md.
- Boundary markers: Absent. There are no delimiters or instructions to ignore embedded commands within the processed email content.
- Capability inventory: The skill can use 'send_sms_to_user' and 'create_scheduled_task' as defined in SKILL.md.
- Sanitization: Absent. No evidence of content filtering or validation is present before the data is processed.
Audit Metadata