batch-send-drafts-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes recipient, subject, and snippet data from Gmail drafts, which are external inputs that could contain malicious payloads.\n
- Ingestion points:
mcp__claude_ai_Gmail__list_draftsandmcp__claude_ai_Gmail__get_thread(SKILL.md, Stage 1).\n - Boundary markers: None identified; email content is processed without specific delimiters or safety instructions.\n
- Capability inventory: Includes shell command execution via
! open, file reads from local skill directories, and file writes to analytics logs.\n - Sanitization: No explicit validation or escaping of draft content is mentioned before it is used in the review table or commands.\n- [COMMAND_EXECUTION]: The skill specifies the use of shell commands to automate the opening of multiple Gmail links.\n
- Evidence:
! open -a \"Google Chrome\" \"<url1>\" \"<url2>\" ...(SKILL.md, Stage 4).\n - Risk: Although intended for workflow efficiency, the dynamic construction of shell commands using external identifiers represents an entry point for command injection if URL components are not strictly validated.
Audit Metadata