gws-gmail-reply
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the 'gws' binary to interact with Gmail. The documentation includes examples of shell command substitution, such as '$(cat reply.txt)', providing the agent with the capability to read local file contents and include them in the email body.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves and automatically quotes original message content when generating replies. This creates a surface where instructions embedded in incoming emails could influence the agent's behavior during the reply process.
- Ingestion points: Gmail message content retrieved via the '--message-id' flag in SKILL.md.
- Boundary markers: There are no documented boundary markers or instructions to treat the quoted content as untrusted data.
- Capability inventory: The agent can send emails, modify recipient fields (CC/BCC), and attach files using the 'gws' CLI.
- Sanitization: No sanitization or filtering of the original message content is specified before it is incorporated into the reply body.
Audit Metadata