google-workspace
Warn
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill's metadata contains deceptive authorship information. While the platform identifies the author as 'adityahimaone', the 'SKILL.md' file claims the author is 'Nous Research'. This discrepancy can mislead users regarding the skill's origin and safety.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from external sources and possesses broad capabilities.
- Ingestion points: The agent retrieves content from Gmail messages, Google Docs, Drive files, and Google Sheets via 'scripts/google_api.py'.
- Boundary markers: No explicit delimiters or instructions are used to separate ingested data from the agent's system prompt.
- Capability inventory: The agent can send/reply to emails, create/delete calendar events, and modify spreadsheet data via 'scripts/google_api.py'.
- Sanitization: No sanitization, validation, or filtering of the retrieved content is implemented before it is processed by the agent.
- [COMMAND_EXECUTION]: The 'scripts/setup.py' script executes shell commands via 'subprocess.check_call' to install the 'google-api-python-client', 'google-auth-oauthlib', and 'google-auth-httplib2' libraries. These are official dependencies required for the skill's functionality.
- [DATA_EXFILTRATION]: The skill handles sensitive Google OAuth credentials and tokens, storing them locally in the 'google_token.json' and 'google_client_secret.json' files. It communicates with official Google API endpoints for its operations, which is consistent with the skill's intended purpose.
Audit Metadata