gmail-to-crm-pipeline
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted inbound email content to perform lead scoring, extraction, and response drafting.
- Ingestion points: The skill uses
mcp__claude_ai_Gmail__gmail_read_messageinreferences/gmail-retrieval.mdto fetch unread lead emails. - Boundary markers: There are no explicit delimiters or 'ignore embedded instructions' warnings defined when the agent processes the untrusted email body for scoring or drafting.
- Capability inventory: The skill has the ability to execute SQL on a Supabase instance (
mcp__claude_ai_Supabase__execute_sql), create Gmail drafts (mcp__claude_ai_Gmail__gmail_create_draft), and write local report files. - Sanitization:
references/gmail-retrieval.mdincludes rules to strip signatures and disclaimers from email bodies, providing a basic level of content filtering. - Mitigation: The skill implements a strict 'human-in-the-loop' policy, explicitly stating 'Never auto-send email -- always create drafts for the user to review and send' in
SKILL.mdandreferences/response-templates.md. This significantly reduces the risk of successful prompt injection through inbound emails. - [SAFE]: The skill uses managed MCP connectors for Gmail and Supabase, avoiding the need for hardcoded API keys or sensitive credential storage within the skill scripts. It also follows data privacy best practices by instructing the agent not to store raw email bodies or PII in local reports.
Audit Metadata