career-ops-plugin-gmail
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses official Google API endpoints (
gmail.googleapis.comandoauth2.googleapis.com) for all network operations, complying with security standards for external communication. - [SAFE]: Sensitive environment variables for OAuth credentials (
GMAIL_CLIENT_ID,GMAIL_CLIENT_SECRET,GMAIL_REFRESH_TOKEN) are managed through the platform's secure environment context and are not hardcoded or exposed. - [SAFE]: Implements a security-focused DMARC alignment check (
isAuthenticEmail) that ignores emails failing authentication, providing protection against potential email spoofing or phishing attempts. - [SAFE]: Performs URL sanitization by checking extracted links against a predefined list of known trackers and marketing platforms, ensuring only legitimate and relevant job leads are processed.
- [SAFE]: Local state management for tracking processed message IDs is confined to a dedicated data directory (
data/gmail-state.json) using standard filesystem operations.
Audit Metadata