conversations
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (messages from an inbox) which creates a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent's context through the
GET /v1/conversations/{conversationId}/messagesendpoint, which retrieves message logs from external contacts. - Boundary markers: The instructions do not define clear delimiters or boundary markers to separate system instructions from the content of the fetched messages.
- Capability inventory: The skill provides capabilities to reply to threads (
POST /v1/messages), search through conversation identifiers, and mark threads as read. - Sanitization: There is no mention of sanitizing or escaping the content of messages before the agent processes or interprets them.
Audit Metadata