gmail
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external email content through
messages listandmessages getcommands, which constitutes an ingestion surface for untrusted data. - Ingestion points:
scripts/gmail.py get_messageandlist_messagesfunctions fetch email snippets and bodies from the Gmail API.- Boundary markers: The skill does not explicitly provide boundary markers or instructions to the agent to ignore embedded instructions within the email content.
- Capability inventory: The agent has the capability to write and send emails (
send,drafts create,drafts send), which could be abused if an incoming email successfully influences the agent's behavior via indirect prompt injection. - Sanitization: The script decodes base64-encoded email bodies using standard libraries but does not perform content-based filtering or sanitization of potential prompt injection payloads within those bodies.
Audit Metadata