recipe-sync-contacts-to-sheet
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted contact data from a directory and writes it to a spreadsheet, creating a potential injection surface.
- Ingestion points: Contact names, emails, and phone numbers are retrieved from the Google Directory via the
gws peopletool inSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded content are defined in the sync instructions.
- Capability inventory: The skill possesses the capability to write data to Google Sheets using the
gws sheetstool. - Sanitization: No sanitization, escaping, or validation of the contact field content is performed before the data is appended to the spreadsheet.
Audit Metadata