integrating-agentkit
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the official Scalekit SDK and standard dependencies (e.g., Requests, LangChain, Google ADK) from public registries to enable API connectivity.
- [PROMPT_INJECTION]: The integration identifies an indirect prompt injection surface as agents process untrusted external data, such as the contents of Gmail messages.
- Ingestion points: User prompts and Gmail message content processed during API calls and agent invocation.
- Boundary markers: None defined in the integration examples.
- Capability inventory: Functionality to read, send, and organize emails via the Gmail API.
- Sanitization: Not present in the provided basic implementation snippets.
- [DATA_EXFILTRATION]: The skill facilitates authorized network communication with the Scalekit platform and well-known third-party services (Gmail API) to manage OAuth flows and perform user-requested tasks.
- [CREDENTIALS_UNSAFE]: The skill explicitly includes guardrails against hardcoding credentials, mandating that sensitive keys (SCALEKIT_CLIENT_SECRET) are managed via environment variables.
Audit Metadata