gog-gmail
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
gogCLI tool to interact with the Gmail API. It follows best practices by recommending the--readonlyflag for non-mutating operations and--dry-runfor testing writes. - [PROMPT_INJECTION]: The skill proactively addresses the risk of indirect prompt injection that can occur when processing external email data.
- Ingestion points: Untrusted email message bodies and metadata retrieved via
gog gmail searchorgetcommands. - Boundary markers: The instructions explicitly mandate the use of the
--wrap-untrustedflag to help the agent distinguish between tool instructions and data content. - Capability inventory: The skill can search, read, move, and send emails via the
gogcommand-line utility. - Sanitization: It utilizes the specialized
--json --wrap-untrustedoutput format to ensure the agent processes Google content within a secure context.
Audit Metadata