gmail
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted data from the Gmail API, which creates a surface for indirect prompt injection where malicious email content could influence the agent's behavior.
- Ingestion points: Email bodies, snippets, and attachment metadata are ingested through
scripts/read_message.pyandscripts/list_messages.py. - Boundary markers: Absent. The skill does not implement delimiters or explicit instructions to help the AI agent distinguish between the skill's operational instructions and the untrusted content of the emails being processed.
- Capability inventory: The skill possesses significant write capabilities, including sending emails (
scripts/send_message.py), modifying or deleting messages and labels (scripts/manage_labels.py), and writing files to the local system (--save-attachmentsflag inscripts/read_message.py). - Sanitization: Absent. There is no evidence of content filtering or sanitization. Specifically, in
scripts/read_message.py, attachment filenames provided by the Gmail API are used directly to construct file paths for writing data, which could potentially be exploited for path traversal if a malicious email contains a manipulated filename.
Audit Metadata