gws-gmail-triage
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (email senders and subjects). This presents a surface for indirect prompt injection, where malicious instructions embedded in email headers could attempt to influence the agent's behavior during triage. (1) Ingestion points: Email metadata (sender, subject) retrieved via the 'gws gmail +triage' command in SKILL.md. (2) Boundary markers: The skill does not define explicit delimiters or instructions to ignore commands within the email content. (3) Capability inventory: The skill provides read-only access to Gmail metadata for summarization. (4) Sanitization: No sanitization or validation of the retrieved email content is specified.
- [COMMAND_EXECUTION]: The skill relies on the execution of the external binary 'gws' to interact with the Gmail API. While this is the intended functionality of the skill, users should ensure the 'gws' tool is from a trusted source.
Audit Metadata