Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external emails, creating a surface for indirect prompt injection attacks.
- Ingestion points: The
cmd_read,cmd_list, andcmd_search_linkscommands inscripts/email_tool.pyretrieve email subjects, bodies (text and HTML versions), and metadata from remote IMAP servers. - Boundary markers: The script does not include boundary markers or explicit instructions to the agent to treat the fetched email content as untrusted data.
- Capability inventory: The script has the capability to write files to the local file system (
cmd_download), perform network connections to IMAP/SMTP servers, and modify email state on the server (cmd_move). - Sanitization: The script performs no sanitization, escaping, or filtering on the retrieved email content before providing it to the agent context.
Audit Metadata