gmail-multi-inbox
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's Gmail messages to suggest categories and generate configuration scripts.
- Ingestion points: The skill uses the
search_gmail_messagestool to scan a comprehensive 6-month history of the user's inbox, including untrusted subject lines and sender addresses (SKILL.md). - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands within the scanned emails are provided, creating a potential surface for adversarial content to influence the agent's logic.
- Capability inventory: The skill has the capability to write sensitive sender metadata to
assets/config.jsonand generate executable JavaScript code inassets/gmail-multi-inbox-setup.jsbased on the untrusted input. The generated script has full access to the user's Gmail API when executed. - Sanitization: The instructions lack specific sanitization logic to filter out potentially malicious strings from email subjects or headers before they are used in categorization or code generation.
- [DYNAMIC_EXECUTION]: The skill generates Google Apps Script source code (
assets/gmail-multi-inbox-setup.js) by populating a template with data derived from the inbox scan. While the script is intended for manual execution by the user on Google's platform, the dynamic generation from untrusted inputs constitutes a security risk if the agent's reasoning is compromised by untrusted data during the generation phase.
Audit Metadata