gws-gmail-reply-all
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
gwsCLI and provides documentation examples that execute shell commands such ascatto read file contents into the command arguments. - [DATA_EXFILTRATION]: The skill enables the transmission of local file data to external recipients via the Gmail API, which could be utilized for data exfiltration if the agent is manipulated into reading sensitive files.
- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection due to its ability to ingest and process external file content.
- Ingestion points: Content from local files is ingested via the
--bodyand--attachflags, as demonstrated in the SKILL.md examples. - Boundary markers: The instructions do not specify any delimiters or ignore-instructions markers to isolate data from agent logic.
- Capability inventory: The skill can read local files and perform network operations to send emails through the
gwsCLI. - Sanitization: There is no evidence of sanitization or content filtering for the data read from local files.
Audit Metadata