gws-gmail-watch
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires and executes the
gwsbinary to perform Gmail operations and manage Google Cloud Pub/Sub resources. - [PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by ingesting untrusted data from external emails. If the agent later processes the content of these emails as instructions, an attacker could manipulate the agent's behavior by sending a specially crafted email.
- Ingestion points: Fetches raw email content from Gmail via Pub/Sub and streams it as NDJSON or writes it to a local directory specified by
--output-dir(SKILL.md). - Boundary markers: While NDJSON provides a structured data format, the skill does not wrap the email body content in specific delimiters or include instructions for the agent to ignore embedded commands within the email text.
- Capability inventory: The skill utilizes the
gwsCLI tool for resource management and data streaming. - Sanitization: The skill does not perform sanitization, filtering, or escaping of the email content before passing it to the agent.
Audit Metadata