google-workspace
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides architecture for building Google Chat bots which ingest untrusted input via message events.
- Ingestion points: The interactive bot handler in
references/chat-api.mdprocesses raw message content from user-generatedMESSAGEevents. - Boundary markers: The provided code templates do not include explicit prompt delimiters or instructions for the agent to ignore embedded commands within user message strings.
- Capability inventory: The skill uses network capabilities to interact with Google Workspace APIs and persistent storage via Cloudflare KV namespaces, as documented in
SKILL.mdandtemplates/oauth-worker.ts. - Sanitization: The basic implementation examples demonstrate direct handling of event data without explicit sanitization or validation of the message text before it is processed by the agent logic.
Audit Metadata