gws-classroom
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
gwscommand-line utility to perform operations on Google Classroom resources, including creating courses, managing students, and handling grading settings. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from external Google Classroom resources, creating a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data is ingested from classroom resources such as
announcements,posts,courseWork, andtopicsduring retrieval operations. - Boundary markers: The skill instructions do not specify any delimiters or instructions for the agent to treat external content as data rather than instructions.
- Capability inventory: The skill provides high-impact capabilities including
courses.delete,invitations.create, andpatchoperations, which could be leveraged if an injection is successful. - Sanitization: There is no evidence of content sanitization or validation for the data returned by the Classroom API before it is processed by the agent.
Audit Metadata