Gmail Delete Email

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.3

Overview

The skill appears to be a disclosed Google Workspace command helper, with a Gmail trash command that users should handle carefully but that fits the stated purpose.

Install only if you intend to let the agent operate your Google Workspace account. Before using any Gmail trash/delete command, have the agent show the sender, subject, date, and message ID, and confirm the exact message to avoid accidental mailbox changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill operationalizes a destructive action (`gog gmail trash <messageId>`) with no built-in requirement for explicit user confirmation, message preview, or scope validation before execution. In an agent setting, this increases the risk of accidental or unauthorized deletion of emails due to misinterpreted instructions, incorrect message IDs, or prompt injection via surrounding workflow context.

VirusTotal

65/65 vendors flagged this skill as clean.