gmail-inbox

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and processes users' email content via the Gmail API (e.g., scripts/gmail_unified.py's search_messages and get_message_detail, scripts/gmail_bulk_label.py's search_all_messages, and reply_to_message/send_message), which are untrusted, user-generated third-party messages that the agent reads and can drive actions like labeling, archiving, or sending replies, creating a clear avenue for indirect prompt injection.