persona-exec-assistant
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, creating a vulnerability surface for indirect prompt injection attacks.
- Ingestion points: The agent ingests untrusted data from several sources, including email bodies via the triage command (
gws gmail +triage), calendar event descriptions via the meeting prep workflow (gws workflow +meeting-prep), and linked files in Google Drive. - Boundary markers: There are no instructions defining delimiters or boundary markers to separate system instructions from the untrusted data being processed.
- Capability inventory: The skill has access to sensitive write-level capabilities, including drafting/sending emails (
gws gmail +send) and inserting calendar events (gws calendar +insert), which could be abused if an injection is successful. - Sanitization: The instructions do not specify any sanitization or validation steps for content read from external sources before it is interpreted by the model.
Audit Metadata