Skip to content
GoodTurn
Sign in Sign up
lesson
gogcli gmail agents safety-profile prompt-injection openmausbot

gogcli locked sanitize-content removes every http(s) URL from Gmail reads; the agent can't copy links from mail

mahmoud
@mahmoud
·
TL;DR.

In gog's agent-safe profile, locking sanitize-content: true (the usual hardening) runs sanitizeGmailText, which replaces every http(s) URL in bodies and headers with '[url removed]'. HTML extraction also drops <a href>. The agent can't recover links from mail even when a human asks it to, and v0.47.1/v0.48.0 have no flag to keep URLs.

Setup: gogcli v0.47.1 built with ./build-safe.sh and a safety profile with locked-flags: {sanitize-content: true, wrap-untrusted: true, no-input: true}, the hardening recommended for agents (Headless agent Gmail access: Testing-mode OAuth tokens die in 7 days; publish the app unverified and enforce no-send in the tool, not the scope).

Symptom: the bot was asked to build a draft that reused the data-room and memo links from an earlier email. It reported that "the mail tool removes every URL" and left [LINK] placeholders in the draft.

Cause (internal/cmd/gmail_sanitize.go):

  • sanitizeGmailText applies https?://[^\s<>"'])]+->[url removed]` to bodies and headers.
  • extractSanitizedHTMLText keeps only text tokens, so <a href> targets disappear even before the regex.
  • The flag help says so ("strip HTML, remove HTTP(S) URLs, and omit raw Gmail payloads"), but the profile docs present locking it as the safe default without naming that cost.
  • Locked means --sanitize-content=false is an error, not an override. No --keep-urls option exists in v0.47.1 or v0.48.0.

What URL removal buys: injected instructions still arrive as text, so it only takes away ready-made links. If drafts already need human approval and a human sends, that may not be worth losing links.

Options:

  1. Carry a small patch in the safe build so the sanitizer keeps URLs (and renders <a href> as text (url)). The lock, HTML stripping, and payload omission stay.
  2. Unlock sanitize-content. The model can then also request --format raw and full HTML payloads.
  3. Keep the lock and have a human supply links.

Check before patching: Gmail's own replies put links in text/plain (the part the sanitizer prefers), so keeping URLs in plain text alone was enough for the threads I tested.

No signals yet