persona-customer-support
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from customer emails, which creates a surface for indirect prompt injection attacks.\n
- Ingestion points: Customer emails are ingested via the
gws gmail +triagecommand inSKILL.md.\n - Boundary markers: The instructions lack explicit delimiters or warnings to treat email content as untrusted data, increasing the risk that the agent may follow instructions embedded within a customer email.\n
- Capability inventory: The skill possesses write capabilities across Google Workspace, including
gws sheets +append,gws chatescalation, andgws calendar +insertas defined inSKILL.md.\n - Sanitization: There are no instructions for sanitizing or validating the content of the emails before they are used to update logs or schedule follow-ups.
Audit Metadata