Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Gmail Forward Skill Security Audit

What the author says it does (original text)

Gmail: Forward a message to new recipients.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Forwarding discloses the original email and its attachments to external recipients by default

Source references: 5
What we found

The command sends the original message—including sender, date, subject, recipients, and original attachments—to addresses supplied through `--to`, `--cc`, or `--bcc`. Attachments are included by default, and an ordinary invocation is neither a preview nor a draft.

Why this matters

A mistaken message ID or recipient can immediately expose sensitive message text, correspondence details, inline images, and attached files. BCC recipients may also be difficult for other recipients to notice.

The risk is supported, though it is the stated forwarding behavior rather than a hidden action. A normal invocation discloses the original sender, date, subject, recipients, and—by default—attachments to the address supplied with `--to`. Immediate sending or original attachments are avoided only when `--dry-run`, `--draft`, or `--no-original-attachments` is explicitly used. Users can require preview/draft mode and recipient review before sending.

SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--message-id` | ✓ | — | Gmail message ID to forward || `--to` | ✓ | — | Recipient email address(es), comma-separated || `--from` | — | — | Sender address (for send-as/alias; omit to use account default) || `--body` | — | — | Optional note to include above the forwarded message (plain text, or HTML with --html) || `--no-original-attachments` | — | — | Do not include file attachments from the original message (inline images in --html mode are preserved) || `--attach` | — | — | Attach a file (can be specified multiple times) || `--cc` | — | — | CC email address(es), comma-separated || `--bcc` | — | — | BCC email address(es), comma-separated || `--html` | — | — | Treat --body as HTML content (default is plain text) |
Show 4 other places
SKILL.md:39In the instructionsOpen original file
| `--html` | — | — | Treat --body as HTML content (default is plain text) || `--dry-run` | — | — | Show the request that would be sent without executing it || `--draft` | — | — | Save as draft instead of sending |
SKILL.md:56In the instructionsOpen original file
- Includes the original message with sender, date, subject, and recipients.- Original attachments are included by default (matching Gmail web behavior).- With --html, inline images are also preserved via cid: references.- In plain-text mode, inline images are not included (matching Gmail web).
SKILL.md:23In the instructionsOpen original file
```bashgws gmail +forward --message-id <ID> --to <EMAILS>```
SKILL.md:60In the instructionsOpen original file
- In plain-text mode, inline images are not included (matching Gmail web).- Use --no-original-attachments to forward without the original message's files.- Use -a/--attach to add extra file attachments. Can be specified multiple times.
Medium risk

`--attach` can send additional local files to email recipients

Source references: 4
What we found

The Skill permits `--attach` multiple times, so it can read and send files beyond the original email. Its example directly attaches `notes.pdf`.

Why this matters

If the agent selects the wrong path, attaches files without item-by-item approval, or chooses a file containing credentials or customer data, that local data will be disclosed to the message recipients.

The risk is supported and is also an explicit attachment feature: when the caller supplies a path through `--attach` (or the example's `-a`), that file is added to the outgoing email, and multiple files may be added. The source does not show automatic selection of arbitrary files; exposure occurs only if a user or agent names a sensitive file and the message is then sent. Users can restrict allowed attachment directories and require `--dry-run` or `--draft` review.

SKILL.md:35In the instructionsOpen original file
| `--no-original-attachments` | — | — | Do not include file attachments from the original message (inline images in --html mode are preserved) || `--attach` | — | — | Attach a file (can be specified multiple times) || `--cc` | — | — | CC email address(es), comma-separated |
Show 3 other places
SKILL.md:49In the instructionsOpen original file
gws gmail +forward --message-id 18f1a2b3c4d --to dave@example.com --body '<p>FYI</p>' --htmlgws gmail +forward --message-id 18f1a2b3c4d --to dave@example.com -a notes.pdfgws gmail +forward --message-id 18f1a2b3c4d --to dave@example.com --no-original-attachments
SKILL.md:61In the instructionsOpen original file
- Use --no-original-attachments to forward without the original message's files.- Use -a/--attach to add extra file attachments. Can be specified multiple times.- Combined size of original and user attachments is limited to 25MB.- With --html, the forwarded block uses Gmail's gmail_quote CSS classes and preserves HTML formatting. Use fragment tags (<p>, <b>, <a>, etc.) — no <html>/<body> wrapper needed.
SKILL.md:39In the instructionsOpen original file
| `--html` | — | — | Treat --body as HTML content (default is plain text) || `--dry-run` | — | — | Show the request that would be sent without executing it || `--draft` | — | — | Save as draft instead of sending |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This Skill uses `gws` to forward a specified Gmail message to one or more new recipients.

View source
SKILL.md:18In the instructionsOpen original file
Forward a message to new recipients
SKILL.md:23In the instructionsOpen original file
```bashgws gmail +forward --message-id <ID> --to <EMAILS>```

The command includes the original email's attachments by default; the user can exclude them or add local files.

View source
SKILL.md:34In the instructionsOpen original file
| `--body` | — | — | Optional note to include above the forwarded message (plain text, or HTML with --html) || `--no-original-attachments` | — | — | Do not include file attachments from the original message (inline images in --html mode are preserved) || `--attach` | — | — | Attach a file (can be specified multiple times) || `--cc` | — | — | CC email address(es), comma-separated |
SKILL.md:57In the instructionsOpen original file
- Includes the original message with sender, date, subject, and recipients.- Original attachments are included by default (matching Gmail web behavior).- With --html, inline images are also preserved via cid: references.- In plain-text mode, inline images are not included (matching Gmail web).- Use --no-original-attachments to forward without the original message's files.- Use -a/--attach to add extra file attachments. Can be specified multiple times.- Combined size of original and user attachments is limited to 25MB.

The default operation sends immediately; `--dry-run` only displays the request, while `--draft` saves it as a draft.

View source
SKILL.md:39In the instructionsOpen original file
| `--html` | — | — | Treat --body as HTML content (default is plain text) || `--dry-run` | — | — | Show the request that would be sent without executing it || `--draft` | — | — | Save as draft instead of sending |
Start here · InstructionsSKILL.md
gws-gmail-forward
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws gmail +forward --message-id <ID> --to <EMAILS>
SKILL.md:44In the instructionsOpen original file
```bashgws gmail +forward --message-id 18f1a2b3c4d --to dave@example.com
Lines read
70
File checksum (to compare versions)
bb8f0888330107d15c8a8f3436f0530861ea4739b73da9afcd7297aaedd1ab0b