gmail-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is Gmail automation via Composio/Rube MCP tools, and while SKILL.md itself doesn’t show any web scraping, it explicitly includes runtime steps like GMAIL_FETCH_EMAILS/GMAIL_FETCH_MESSAGE_BY_MESSAGE_ID with include_payload=true, which would ingest outsider-authored email body text into the agent’s LLM context for composing replies/sending content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires connecting to the MCP server at https://rube.app/mcp at runtime (via RUBE_SEARCH_TOOLS) to fetch current tool schemas that directly govern agent behavior and available instructions, making this an external runtime dependency that controls prompts.