wecomcli-email
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and potentially untrusted email content, which serves as a vector for indirect prompt injection. \n
- Ingestion points: Email bodies and attachments are retrieved via the
wecom-cli mail getcommand (referenced inreferences/get-mail.md). \n - Boundary markers: The skill defines explicit defensive rules in
references/security.mdto ignore any directive text found in email bodies and to add a 'Request Source Reminder' if recipient addresses are extracted from email content. \n - Capability inventory: The skill possesses the capability to send emails to arbitrary addresses (
wecom-cli mail send) and download media files (wecomcli-media). \n - Sanitization: The instructions in
references/security.mdandreferences/send-mail.mdmandate that the agent refuse to include<script>tags, event handlers, or malicious URI schemes in outgoing content. \n - [COMMAND_EXECUTION]: The skill performs its operations by executing the
wecom-clibinary. This tool is a standard part of the vendor's ecosystem used to interact with Enterprise WeChat APIs.
Audit Metadata