google-docs-connector
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by reading and processing content from external Google Docs, which introduces a surface for indirect prompt injection attacks.
- Ingestion points: The
get_documentaction retrieves full text content and structure from documents, andsearch_documentsretrieves document metadata, both of which are ingested into the agent's context (SKILL.md). - Boundary markers: The skill does not define specific delimiters or instructions to the agent to disregard instructions found within the document content, increasing the risk that the agent might treat document text as valid commands.
- Capability inventory: The skill provides powerful administrative capabilities, including
share_document(permission management),replace_text, andbatch_update(arbitrary API requests), which could be misused if an agent is successfully subverted via injected instructions. - Sanitization: There is no evidence of content sanitization or instruction filtering applied to the retrieved document data before it is presented to the agent.
Audit Metadata