T09 · Insecure Skill Coding Practices
- Location
SKILL.md:22- Finding
Untrusted Email Content Can Influence Automatically Sent Replies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22 and 34–40
Vulnerability Type: Missing trust-boundary enforcement for attacker-controlled email content
Risk Level: MediumVulnerable Instructions:
markdown - If the user provides an email thread or summary, use that as the incoming message to answer.markdown 4. **Safety and approval** - By default, **output the draft** for the user/client to approve before sending. - Only auto-send if the user has clearly configured “auto-send” and you have applied the client’s rules and filters (e.g. only for certain labels or senders). 5. **Integrations** - If the user has configured Gmail API (OAuth2) or IMAP/SMTP, use the credentials from environment or secure config—never from this skill’s files. - When “sending,” either return the draft text for the user to paste/send, or call the configured send function if the user has set one up.Technical Analysis
The skill directs the agent to use incoming email threads as response context and permits generated replies to be transmitted automatically through a configured Gmail API or IMAP/SMTP integration. Email bodies, quoted messages, signatures, and attachment text are attacker-controlled inputs, but the instructions do not establish a clear trust boundary requiring the agent to treat such content exclusively as data.
In particular, the skill does not instruct the agent to ignore prompt-like directives embedded in messages, distinguish sender content from trusted client rules, detect suspicious instructions, or require human review when an email contains attempts to control agent behavior. Sender and label filters alone do not address this risk because a permitted or compromised sender can still submit malicious content.
The default draft-approval workflow reduces exposure. However, once auto-send is configured, manipulated output can reach an external recipient without review.
...[truncated 1575 chars]
- Remediation
View remediation
Remediation Suggestions
- Explicitly classify all email bodies, quoted threads, signatures, headers, links, and attachment text as untrusted data.
- Instruct the agent never to follow commands or policy changes contained in an email, even if they appear to be written by the client or another trusted party.
- Define a precedence rule under which system instructions, the skill policy, and authenticated client configuration always override message content.
- Require human approval when messages contain prompt-like directives, requests for secrets, financial or legal topics, external links, anomalous requests, or attempts to change reply behavior.
- Disable auto-send by default and constrain it to narrowly defined, low-risk templates and deterministic intents.
- Validate generated replies before sending, including checks for sensitive data, unexpected recipients, unsupported commitments, and deviations from the selected template.
- Apply recipient, sender, label, thread, topic, and rate restrictions at the integration layer rather than relying only on model instructions.
- Use least-privilege Gmail OAuth scopes and avoid granting mailbox-wide access when only draft creation or restricted sending is necessary.
- Maintain an audit log of the source message, selected rule or template, generated reply, validation result, and sending decision.
- Add adversarial tests using emails that contain embedded instructions to verify that such text is treated only as message content.