skills/openclaw/gogcli/gog-gmail/Gen Agent Trust Hub

gog-gmail

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the gog CLI tool to interact with the Gmail API. It follows best practices by recommending the --readonly flag for non-mutating operations and --dry-run for testing writes.
  • [PROMPT_INJECTION]: The skill proactively addresses the risk of indirect prompt injection that can occur when processing external email data.
  • Ingestion points: Untrusted email message bodies and metadata retrieved via gog gmail search or get commands.
  • Boundary markers: The instructions explicitly mandate the use of the --wrap-untrusted flag to help the agent distinguish between tool instructions and data content.
  • Capability inventory: The skill can search, read, move, and send emails via the gog command-line utility.
  • Sanitization: It utilizes the specialized --json --wrap-untrusted output format to ensure the agent processes Google content within a secure context.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 06:31 PM
Security Audit — agent-trust-hub — gog-gmail