gmail-automation
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted email content which could contain malicious instructions. 1. Ingestion points:
scripts/gmail.py searchandscripts/gmail.py get(SKILL.md). 2. Boundary markers: None present in the instructions. 3. Capability inventory: Sending emails, modifying labels, and creating drafts viascripts/gmail.py. 4. Sanitization: None documented for the ingested content. - [COMMAND_EXECUTION]: The skill invokes local Python scripts (
scripts/auth.pyandscripts/gmail.py) which are missing from the provided skill files, preventing full verification of the code being executed. - [DATA_EXFILTRATION]: The documentation describes an OAuth token refresh mechanism using a 'Google's cloud function'. This is a potential exfiltration vector as standard Google clients use official API endpoints; a custom cloud function could intercept authentication credentials.
- [METADATA_POISONING]: The skill's frontmatter contains a 'risk: critical' tag, which is an unusual metadata field that may be intended to influence safety evaluations or reflect undocumented dangerous behavior.
Audit Metadata