newsletters
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script located at
scripts/digest-newsletters.py. While this is part of the intended automation, it involves executing arbitrary code from the local filesystem. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from external Gmail newsletters to extract 'high-signal' items and generate summaries. An attacker could embed malicious instructions within a newsletter to influence the agent's behavior or output.
- Ingestion points: External newsletter emails fetched via Gmail API.
- Boundary markers: No delimiters or 'ignore' instructions are specified to separate untrusted email content from the agent's processing logic.
- Capability inventory: The skill executes local Python scripts (
scripts/digest-newsletters.py), reads local files (state/gmail-token.json), and writes to external services (Notion). - Sanitization: There are no documented steps for sanitizing, escaping, or validating the content of the emails before they are processed by the AI model.
Audit Metadata