gws-gmail-reply-all
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local binary named
gwsto perform Gmail operations, which is the intended core functionality of the skill.- [INDIRECT_PROMPT_INJECTION]: The skill operates on Gmail messages, which are externally controlled and untrusted, creating a surface for indirect prompt injection attacks. - Ingestion points: Email content identified by the
--message-idflag in SKILL.md. - Boundary markers: No explicit delimiters or instructions are used to separate untrusted email content from agent instructions.
- Capability inventory: The skill can execute shell commands via the
gwsbinary and send emails to multiple recipients. - Sanitization: There is no documentation of content sanitization or filtering for the email body or thread context.
Audit Metadata