@tank/gmail
Pass
Audited by Gen Agent Trust Hub on May 31, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from Gmail messages while possessing capabilities to perform sensitive actions.
- Ingestion points: Untrusted data enters the agent's context through message reading and searching functions (e.g.,
searchMessages). - Boundary markers: The skill documentation lacks explicit instructions for the agent to treat email content as untrusted or to ignore instructions embedded within the text of messages.
- Capability inventory: The skill allows sending emails (
sendEmail) and grants read access to the local filesystem (./**viatank.json), creating a path for data exfiltration if the agent is manipulated. - Sanitization: There is no evidence of filtering or sanitization of email body content to prevent command-like structures from influencing the agent's behavior.
- [NO_CODE]: The skill consists solely of instructions (SKILL.md) and configuration (tank.json) without any accompanying scripts or executables, which reduces the surface area for direct malicious code execution.
Audit Metadata