gws-gmail
Pass
Audited by Gen Agent Trust Hub on May 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the gws binary and uses it to perform Gmail operations through structured shell commands like gws gmail messages get.
- [PROMPT_INJECTION]: The skill ingests untrusted data from emails, creating a surface for indirect prompt injection where malicious instructions could be embedded in messages. 1. Ingestion points: Untrusted content enters the context via +read, +triage, +watch, and messages resource commands. 2. Boundary markers: No specific delimiters or safety warnings for the agent to ignore embedded instructions are provided in SKILL.md. 3. Capability inventory: The skill has broad capabilities including sending emails (+send, +reply), managing drafts, and altering account settings. 4. Sanitization: There is no evidence of input validation or escaping for the retrieved email content.
Audit Metadata