gmail-automation
Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill's documentation indicates that 'Tokens automatically refresh when expired using Google's cloud function.' Standard OAuth2 implementations perform token refreshes directly with Google's official API endpoints (e.g., oauth2.googleapis.com). Routing refresh tokens through an intermediary cloud function—likely controlled by the skill author or a third party—introduces a significant risk of credential theft or token interception.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (email content) which could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: The
scripts/gmail.py get MESSAGE_IDcommand retrieves full email bodies into the agent's context. - Boundary markers: No specific delimiters or 'ignore embedded instructions' warnings are suggested in the manual to separate email content from system instructions.
- Capability inventory: The skill provides capabilities to send emails (
send), create drafts (create-draft), and modify labels (modify), which an attacker could abuse via a successfully injected prompt to exfiltrate data or spam contacts. - Sanitization: There is no evidence of sanitization or filtering applied to the retrieved email content before it is processed by the agent.
Audit Metadata