Goodbye Google Gmailinbox Edition

• Outcome: Pass
• Latest audit: Jun 16, 2026 at 2:23 PM UTC
• Version:
  1.0.0

Overview

This is a guidance-only Gmail migration skill with disclosed privacy and account-deletion advice, and I found no hidden execution, credential access, or data exfiltration.

Install this only if you want advice about leaving Gmail or reducing Google dependency. Treat account deletion as a manual, high-impact step: export your data, update critical accounts, run both inboxes in parallel for weeks, and confirm dependencies before deleting anything.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes broad, generic terms like "privacy" and "data privacy" that can match many unrelated conversations, causing the skill to activate outside its intended context. This creates prompt-surface expansion: users may receive unsolicited guidance or the model may route unrelated requests into this skill, increasing the chance of confusion, inappropriate advice, or interaction hijacking by an over-eager skill.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The skill includes guidance to permanently delete a Gmail account but does not pair that step with an explicit warning about irreversibility, service breakage, or the need to confirm backups and account dependencies first. In a migration skill, users may follow the steps operationally, and missing safety language can lead to unintended data loss or loss of access to linked Google services.

VirusTotal

61/61 vendors flagged this skill as clean.