gmail-automation
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection attacks because it ingests untrusted external data and provides significant capabilities to modify the user's environment.
- Ingestion points: The skill reads external content through tools like GMAIL_FETCH_EMAILS, GMAIL_FETCH_MESSAGE_BY_MESSAGE_ID, GMAIL_LIST_DRAFTS, and GMAIL_GET_ATTACHMENT (found in SKILL.md).
- Boundary markers: There are no instructions or delimiters defined to isolate untrusted email content or warn the agent against embedded instructions within retrieved data.
- Capability inventory: The skill possesses significant capabilities including sending emails (GMAIL_SEND_EMAIL, GMAIL_REPLY_TO_THREAD), deleting labels (GMAIL_DELETE_LABEL), and bulk modifying messages (GMAIL_BATCH_MODIFY_MESSAGES).
- Sanitization: No evidence of sanitization, filtering, or validation of retrieved email content is present in the instructions.
- [DATA_EXFILTRATION]: The skill performs network operations to an external domain to provide its core functionality.
- Evidence: The instructions direct the user to add 'https://rube.app/mcp' as an MCP server endpoint.
- Context: This endpoint belongs to the vendor's infrastructure for the Rube MCP service and is used for Gmail automation connectivity.
Audit Metadata