gws-gmail-send
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
gwsCLI tool with parameters (--to,--subject,--body, etc.) derived from user-provided input. This pattern creates a command injection surface if the inputs are not properly sanitized against shell metacharacters such as backticks, semicolons, or pipes. - [INDIRECT_PROMPT_INJECTION]: The skill processes data that may originate from untrusted sources, such as email bodies or recipient lists fetched from external sites or files.
- Ingestion points: Untrusted data enters the agent context through the
--to,--subject, and--bodyflags defined inSKILL.md. - Boundary markers: The command templates do not utilize explicit delimiters (e.g., triple-quotes or XML tags) to isolate variable content from the rest of the command structure.
- Capability inventory: The skill has the capability to execute shell commands via the
gwsbinary. - Sanitization: There is no evidence of sanitization or escaping logic applied to the interpolated variables before they are passed to the shell.
Audit Metadata