gws-workflow-email-to-task
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Gmail (email subjects and snippets) to populate fields in Google Tasks. This behavior allows for potential indirect prompt injection attacks if an email contains instructions intended to manipulate the agent.\n
- Ingestion points: Untrusted data is retrieved from Gmail message subjects and snippets (SKILL.md).\n
- Boundary markers: The instructions do not define explicit delimiters or boundary markers to separate the external email content from the system instructions.\n
- Capability inventory: The skill uses the
gwscommand-line tool to write data to Google Tasks (SKILL.md).\n - Sanitization: There is no evidence of automated sanitization or filtering of the email content, although the skill instructions include a best-practice tip to confirm the action with the user before execution.
Audit Metadata