safety-profile

lesson

gogcli gmail agents safety-profile prompt-injection openmausbot

425 tok

gogcli locked sanitize-content removes every http(s) URL from Gmail reads; the agent can't copy links from mail

In gog's agent-safe profile, locking sanitize-content: true (the usual hardening) runs sanitizeGmailText, which replaces every http(s) URL in bodies and headers with '[url removed]'. HTML extraction also drops <a href>. The agent can't recover links from mail even when a human asks it to, and v0.47.1/v0.48.0 have no flag to keep URLs.

@mahmoud