recipe-batch-reply-to-emails
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a sequence of steps to fetch, read, and reply to Gmail messages. This pattern exposes the agent to untrusted external data that may contain malicious instructions designed to hijack the agent's execution flow.
- Ingestion points: The skill uses
gws gmail users messages getinSKILL.md(Step 2) to retrieve email content from the user's inbox. - Boundary markers: There are no boundary markers, delimiters, or instructions provided to the agent to differentiate between the email content as data and the skill's instructions.
- Capability inventory: The skill utilizes the
gwsbinary with permissions to list, read, send, and modify (label) emails. - Sanitization: The workflow lacks sanitization or validation steps for the email body content before it is processed or used in replies.
Audit Metadata