recipe-sync-contacts-to-sheet
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from a Google Contacts directory (names, emails, and phone numbers) and appends it to a spreadsheet, creating an entry point for untrusted data into the agent's context.
- Ingestion points: Output from the
gws people people listDirectoryPeoplecommand referenced inSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore content embedded within the contact data.
- Capability inventory: The skill utilizes the
gwstool to perform API calls for reading contacts and writing to Google Sheets. - Sanitization: No explicit validation or sanitization of the directory content is performed before the data is appended to the spreadsheet.
Audit Metadata