recipe-search-and-export-emails
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Gmail messages, which creates a surface for indirect prompt injection attacks.
- Ingestion points: Email message content is retrieved and processed via
gws gmail users messages getinSKILL.md. - Boundary markers: There are no boundary markers or instructions to the agent to ignore potentially malicious content within the retrieved emails.
- Capability inventory: The skill has the capability to execute shell commands (
gws) and write data to the local file system using shell redirection (> project-emails.json). - Sanitization: No sanitization or filtering of the email body is performed before the data is handled by the agent or exported.
- [COMMAND_EXECUTION]: The skill relies on the execution of shell commands via the
gwsCLI tool to interact with Google Workspace APIs. - Evidence: Steps in
SKILL.mddemonstrate the use ofgws gmail users messages listandgws gmail users messages getto interact with private user data.
Audit Metadata