Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Gmail Reply Skill Security Audit

What the author says it does (original text)

Gmail: Reply to a message (handles threading automatically).

Independent security check

Do not install or run it yet

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Added recipients receive the automatically quoted original message, risking conversation disclosure

Source references: 3
What we found

The command permits extra recipients through `--to`, `--cc`, or `--bcc`, while stating that it quotes the original message in the reply body. An added address may therefore receive prior content that was not intended for it; a BCC address is also hidden from other recipients.

Why this matters

If the original email contains customer data, internal discussions, contract details, or personal information, a mistaken or unauthorized added address can receive it.

The skill permits adding To, CC, and BCC recipients and explicitly says it quotes the original message in the reply body. Consequently, an added recipient could receive prior conversation content; a BCC recipient may also be hidden from others. This is normal reply functionality, but it creates a real accidental-disclosure risk. The user can require a preview of final recipients and quoted content, or restrict the action to saving a draft.

SKILL.md:33In the instructionsOpen original file
| `--from` | — | — | Sender address (for send-as/alias; omit to use account default) || `--to` | — | — | Additional To email address(es), comma-separated || `--attach` | — | — | Attach a file (can be specified multiple times) || `--cc` | — | — | CC email address(es), comma-separated || `--bcc` | — | — | BCC email address(es), comma-separated || `--html` | — | — | Treat --body as HTML content (default is plain text) |
Show 2 other places
SKILL.md:55In the instructionsOpen original file
- Automatically sets In-Reply-To, References, and threadId headers.- Quotes the original message in the reply body.- --to adds extra recipients to the To field.- Use -a/--attach to add file attachments. Can be specified multiple times.
SKILL.md:54In the instructionsOpen original file
- Automatically sets In-Reply-To, References, and threadId headers.- Quotes the original message in the reply body.- --to adds extra recipients to the To field.- Use -a/--attach to add file attachments. Can be specified multiple times.
High risk

File attachments can transmit local data to external email recipients

Source references: 3
What we found

`--attach` reads and sends a file and may be specified repeatedly for multiple files. The documentation shows no attachment-path validation, sensitive-data check, or mandatory pre-send confirmation.

Why this matters

If the agent selects the wrong file or recipient, local documents, credential exports, customer records, or other data could be emailed externally.

The documentation explicitly supports attaching local files multiple times, and its example attaches a document. This is a normal email feature chosen by the user, but an agent selecting the wrong file or failing to inspect it could send sensitive local data with the reply. The provided source does not describe attachment-content checks. The user can restrict accessible directories and require `--dry-run` or `--draft` for review first.

SKILL.md:34In the instructionsOpen original file
| `--to` | — | — | Additional To email address(es), comma-separated || `--attach` | — | — | Attach a file (can be specified multiple times) || `--cc` | — | — | CC email address(es), comma-separated |
Show 2 other places
SKILL.md:57In the instructionsOpen original file
- --to adds extra recipients to the To field.- Use -a/--attach to add file attachments. Can be specified multiple times.- With --html, the quoted block uses Gmail's gmail_quote CSS classes and preserves HTML formatting. Use fragment tags (<p>, <b>, <a>, etc.) — no <html>/<body> wrapper needed.
SKILL.md:48In the instructionsOpen original file
gws gmail +reply --message-id 18f1a2b3c4d --body '<b>Bold reply</b>' --htmlgws gmail +reply --message-id 18f1a2b3c4d --body 'Updated version' -a updated.docxgws gmail +reply --message-id 18f1a2b3c4d --body 'Draft reply' --draft
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Replies send immediately by default and may use a different sender alias

Source references: 3
What we found

Without the optional `--draft` or `--dry-run` flags, the command performs the send; `--from` can select a configured sender address or alias. Wrong content, thread, or alias can therefore be sent externally immediately under the user's identity.

Why this matters

The user could make an unreviewed commitment, reply to the wrong contact, or send under an inappropriate business or personal identity, causing reputational, compliance, or commercial consequences.

`--from` can select a configured sender address or alias, while `--dry-run` and `--draft` are optional; their descriptions indicate that an ordinary invocation executes the send. Selecting the wrong message, text, or alias could therefore send externally under the user's identity immediately. This matches the skill's stated reply purpose and is not hidden behavior, but it carries business and identity risk. The user can require draft-only or dry-run operation and confirm the thread, sender identity, and recipients before sending.

SKILL.md:32In the instructionsOpen original file
| `--body` | ✓ | — | Reply body (plain text, or HTML with --html) || `--from` | — | — | Sender address (for send-as/alias; omit to use account default) || `--to` | — | — | Additional To email address(es), comma-separated |
Show 2 other places
SKILL.md:38In the instructionsOpen original file
| `--html` | — | — | Treat --body as HTML content (default is plain text) || `--dry-run` | — | — | Show the request that would be sent without executing it || `--draft` | — | — | Save as draft instead of sending |
SKILL.md:60In the instructionsOpen original file
- With --html, inline images in the quoted message are preserved via cid: references.- Use --draft to save the reply as a draft instead of sending it immediately.- For reply-all, use +reply-all instead.

Inside this skill

5 instruction sections

This Skill uses `gws gmail +reply` to reply to a Gmail message by message ID and automatically handles thread association.

View source
SKILL.md:23In the instructionsOpen original file
```bashgws gmail +reply --message-id <ID> --body <TEXT>```
SKILL.md:54In the instructionsOpen original file
- Automatically sets In-Reply-To, References, and threadId headers.- Quotes the original message in the reply body.

Replies are sent by default; `--dry-run` and `--draft` are optional preview and draft safeguards.

View source
SKILL.md:38In the instructionsOpen original file
| `--html` | — | — | Treat --body as HTML content (default is plain text) || `--dry-run` | — | — | Show the request that would be sent without executing it || `--draft` | — | — | Save as draft instead of sending |
SKILL.md:60In the instructionsOpen original file
- With --html, inline images in the quoted message are preserved via cid: references.- Use --draft to save the reply as a draft instead of sending it immediately.- For reply-all, use +reply-all instead.

The Skill can select a sender alias, add recipients, and attach local files, so its authority extends beyond a simple text response to the original sender.

View source
SKILL.md:32In the instructionsOpen original file
| `--body` | ✓ | — | Reply body (plain text, or HTML with --html) || `--from` | — | — | Sender address (for send-as/alias; omit to use account default) || `--to` | — | — | Additional To email address(es), comma-separated || `--attach` | — | — | Attach a file (can be specified multiple times) || `--cc` | — | — | CC email address(es), comma-separated || `--bcc` | — | — | BCC email address(es), comma-separated || `--html` | — | — | Treat --body as HTML content (default is plain text) |

The documentation delegates authentication, global flags, and security rules to another Skill not included in the supplied evidence, and recommends a generation command if it is missing. Those rules and generated contents cannot be verified here.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Start here · InstructionsSKILL.md
gws-gmail-reply
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws gmail +reply --message-id <ID> --body <TEXT>
SKILL.md:43In the instructionsOpen original file
```bashgws gmail +reply --message-id 18f1a2b3c4d --body 'Thanks, got it!'
Lines read
67
File checksum (to compare versions)
db8d6f0ebf58069698baea5cf3614e92f7dcd496e5b42547c25b064bb2b6790a