gws

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly reads full Gmail message bodies (e.g., "gws gmail users messages get" with "format": "full" and the "+triage" helper) and uses that untrusted, user-generated email content to drive actions like replies, forwards, and calendar changes, so third-party content could indirectly inject instructions that affect agent behavior.