gws-gmail-watch
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exposes the agent to untrusted data by streaming incoming Gmail messages, which may contain instructions targeting the LLM.
- Ingestion points: The
gws gmail +watchcommand streams external email content directly into the agent's context (SKILL.md). - Boundary markers: There are no explicit instructions or delimiters defined to help the agent distinguish between message content and legitimate system instructions.
- Capability inventory: The skill executes the
gwsCLI to interact with Google Workspace APIs (SKILL.md). - Sanitization: The skill does not mention any filtering, escaping, or sanitization of the email body content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill's functionality is built around the execution of the
gwscommand-line utility, which is a required binary for the skill to operate.
Audit Metadata