Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Gmail Reply All Skill Security Audit

What the author says it does (original text)

Gmail: Reply-all to a message (handles threading automatically).

Independent security check

Do not install or run it yet

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Email content or local attachments can be sent to added To/CC/BCC recipients

Source references: 3
What we found

The command automatically includes original conversation participants while permitting arbitrary added To, CC, or invisible BCC recipients and local attachments. It can also remove the original sender or Reply-To target. A misdirected or compromised agent could therefore alter the audience and transmit reply content or files outside the original conversation.

Why this matters

The reply body, quoted conversation history, and selected local files could be disclosed. BCC recipients are hidden from the other recipients, while removal of the original target can make the diverted message less visible to conversation participants.

The Skill is intentionally designed to reply on the user's behalf, but it also permits adding outside To, CC, or BCC addresses and attaching local files. If recipients or attachments are not verified, the reply, quoted context, or files could reach unintended parties; BCC recipients are hidden from the others. A user can restrict it to original recipients and require a complete recipient and attachment preview before sending.

SKILL.md:33In the instructionsOpen original file
| `--from` | — | — | Sender address (for send-as/alias; omit to use account default) || `--to` | — | — | Additional To email address(es), comma-separated || `--attach` | — | — | Attach a file (can be specified multiple times) || `--cc` | — | — | CC email address(es), comma-separated || `--bcc` | — | — | BCC email address(es), comma-separated || `--html` | — | — | Treat --body as HTML content (default is plain text) || `--dry-run` | — | — | Show the request that would be sent without executing it || `--draft` | — | — | Save as draft instead of sending || `--remove` | — | — | Exclude recipients from the outgoing reply (comma-separated emails) |
Show 2 other places
SKILL.md:55In the instructionsOpen original file
- Replies to the sender and all original To/CC recipients.- Use --to to add extra recipients to the To field.- Use --cc to add new CC recipients.- Use --bcc for recipients who should not be visible to others.- Use --remove to exclude recipients from the outgoing reply, including the sender or Reply-To target.- The command fails if no To recipient remains after exclusions and --to additions.- Use -a/--attach to add file attachments. Can be specified multiple times.- With --html, the quoted block uses Gmail's gmail_quote CSS classes and preserves HTML formatting. Use fragment tags (<p>, <b>, <a>, etc.) — no <html>/<body> wrapper needed.
SKILL.md:61In the instructionsOpen original file
- The command fails if no To recipient remains after exclusions and --to additions.- Use -a/--attach to add file attachments. Can be specified multiple times.- With --html, the quoted block uses Gmail's gmail_quote CSS classes and preserves HTML formatting. Use fragment tags (<p>, <b>, <a>, etc.) — no <html>/<body> wrapper needed.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

A missing dependency triggers generation and trust of security instructions absent from the audit

Source references: 2
What we found

The Skill delegates authentication, global flags, and security rules to a neighboring `gws-shared` Skill. If that file is absent, it tells the agent to run `gws generate-skills`. The generated files and instructions are not in the supplied evidence, expanding the instruction set the agent will subsequently follow.

Why this matters

If the generator, installed `gws` binary, or generated material differs from the user's expectations, the agent could operate Gmail under unaudited authentication or security rules. The specific behavior cannot be determined from this submission.

What this evidence establishes

This is an active prerequisite: it requires reading a neighboring Skill and running a generation command if that file is absent, so authentication and security rules are delegated beyond the submitted content. However, the evidence includes neither `gws-shared`, the generator implementation, nor its output, so it cannot establish what would be written, which permissions would be requested, or whether those instructions are harmful. A user can ask for a bundled, pinned dependency or separately review the generator's source and output before running it.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Show 1 other places
SKILL.md:68In the instructionsOpen original file
- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth- [gws-gmail](../gws-gmail/SKILL.md) — All send, read, and manage email commands
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Normal usage sends immediately from the user's account; draft and preview are not default safeguards

Source references: 4
What we found

The basic command executes the reply directly. Both `--dry-run` and `--draft` are optional, and the documentation explicitly contrasts draft creation with immediate sending. No visible instruction requires showing the body and recipients and obtaining user confirmation first.

Why this matters

An incorrect body, conversation, or recipient selection can create an irreversible external communication and affect the user's professional relationships, commitments, or account reputation.

The basic usage performs a real reply-all, while request preview and draft creation require optional flags; the documentation explicitly contrasts drafts with immediate sending. Immediate delivery matches the stated purpose and is not hidden, but email delivery is an external, hard-to-reverse account action, and the visible instructions do not require prior confirmation of recipients and content. A user can require `--dry-run` or `--draft` first and authorize actual sending separately.

SKILL.md:23In the instructionsOpen original file
```bashgws gmail +reply-all --message-id <ID> --body <TEXT>```
Show 3 other places
SKILL.md:38In the instructionsOpen original file
| `--html` | — | — | Treat --body as HTML content (default is plain text) || `--dry-run` | — | — | Show the request that would be sent without executing it || `--draft` | — | — | Save as draft instead of sending || `--remove` | — | — | Exclude recipients from the outgoing reply (comma-separated emails) |
SKILL.md:64In the instructionsOpen original file
- With --html, inline images in the quoted message are preserved via cid: references.- Use --draft to save the reply as a draft instead of sending it immediately.
SKILL.md:22In the instructionsOpen original file
```bashgws gmail +reply-all --message-id <ID> --body <TEXT>```

Inside this skill

5 instruction sections

This Skill documents a Gmail command that replies, by message ID, to the sender and all original To/CC recipients; the actual operation is performed by the external `gws` executable.

View source
SKILL.md:18In the instructionsOpen original file
Reply-all to a message (handles threading automatically)
SKILL.md:23In the instructionsOpen original file
```bashgws gmail +reply-all --message-id <ID> --body <TEXT>```
SKILL.md:55In the instructionsOpen original file
- Replies to the sender and all original To/CC recipients.- Use --to to add extra recipients to the To field.

It can add or remove recipients, use BCC, attach local files, and select a sender alias, so its capabilities extend beyond a simple reply to the original conversation.

View source
SKILL.md:32In the instructionsOpen original file
| `--body` | ✓ | — | Reply body (plain text, or HTML with --html) || `--from` | — | — | Sender address (for send-as/alias; omit to use account default) || `--to` | — | — | Additional To email address(es), comma-separated || `--attach` | — | — | Attach a file (can be specified multiple times) || `--cc` | — | — | CC email address(es), comma-separated || `--bcc` | — | — | BCC email address(es), comma-separated || `--html` | — | — | Treat --body as HTML content (default is plain text) |
SKILL.md:40In the instructionsOpen original file
| `--draft` | — | — | Save as draft instead of sending || `--remove` | — | — | Exclude recipients from the outgoing reply (comma-separated emails) |

Pre-send preview and draft creation are optional modes; the documentation states that `--draft` must be used to avoid sending immediately.

View source
SKILL.md:38In the instructionsOpen original file
| `--html` | — | — | Treat --body as HTML content (default is plain text) || `--dry-run` | — | — | Show the request that would be sent without executing it || `--draft` | — | — | Save as draft instead of sending || `--remove` | — | — | Exclude recipients from the outgoing reply (comma-separated emails) |
SKILL.md:64In the instructionsOpen original file
- With --html, inline images in the quoted message are preserved via cid: references.- Use --draft to save the reply as a draft instead of sending it immediately.

The submitted material does not include the authentication and security rules; it requires a neighboring Skill and directs the agent to run a generator if that Skill is absent. Authentication scope, confirmation behavior, and generated content therefore cannot be verified from the supplied source alone.

View source
SKILL.md:8In the instructionsOpen original file
    category: "productivity"    requires:      bins:        - gws    cliHelp: "gws gmail +reply-all --help"---
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Start here · InstructionsSKILL.md
gws-gmail-reply-all
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws gmail +reply-all --message-id <ID> --body <TEXT>
SKILL.md:44In the instructionsOpen original file
```bashgws gmail +reply-all --message-id 18f1a2b3c4d --body 'Sounds good to me!'
Lines read
70
File checksum (to compare versions)
2bd6c3b4b8a849e609f50858d93943854b78b59ecc695acb17376b7196faad48