recipe-forward-labeled-emails
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates a workflow that ingests untrusted data from Gmail messages and processes it directly into a new email body, creating a surface for indirect prompt injection.
- Ingestion points: Gmail message bodies are retrieved dynamically in step 2 using the
gws gmail users messages getcommand inSKILL.md. - Boundary markers: Missing. The original message body is directly interpolated into the new email body template without text delimiters or instructions to ignore embedded commands.
- Capability inventory: Contains communication capabilities through the
gws gmail +sendcommand used in step 3. - Sanitization: Missing. There is no automated escaping or validation mechanism specified for the content prior to forwarding.
Audit Metadata