Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Gmail Triage Skill Security Audit

What the author says it does (original text)

Gmail: Show unread inbox summary (sender, subject, date).

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Email metadata and subjects are displayed or passed to another command

Source references: 5
What we found

The Skill directs the agent to read and output unread-message senders, subjects, and dates; its JSON example also sends subjects to `jq`. Subjects can contain private, commercial, or security-sensitive information.

Why this matters

Running it in a shared terminal, persistent log, chat transcript, or environment accessible to other tools may expose email identities and subjects to unintended people or systems.

Legitimate use of this code

Displaying sender, subject, and date is the skill's explicitly stated purpose; the `jq` example merely filters subjects from the command's output. The evidence does not show transmission to an external service or writing to a file. Still, email metadata will appear in terminal output, so screen sharing or retained command logs could expose sensitive content.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:18In the instructionsOpen original file
Show unread inbox summary (sender, subject, date)
Show 4 other places
SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--max` | — | 20 | Maximum messages to show (default: 20) || `--query` | — | — | Gmail search query (default: is:unread) || `--labels` | — | — | Include label names in output |
SKILL.md:37In the instructionsOpen original file
```bashgws gmail +triagegws gmail +triage --max 5 --query 'from:boss'gws gmail +triage --format json | jq '.[].subject'gws gmail +triage --labels```
SKILL.md:39In the instructionsOpen original file
gws gmail +triage --max 5 --query 'from:boss'gws gmail +triage --format json | jq '.[].subject'gws gmail +triage --labels
SKILL.md:45In the instructionsOpen original file
- Read-only — never modifies your mailbox.- Defaults to table output format.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

A missing shared rules file triggers file generation of unspecified scope

Source references: 2
What we found

The prerequisite directs the agent to run `gws generate-skills` when the shared Skill file is missing. This is beyond displaying an email summary and creates local instruction material that was not supplied for audit.

Why this matters

The generated files are a lasting change, and their authentication, security, or command rules may affect how the agent accesses Gmail. The evidence does not establish their locations, overwrite behavior, or contents.

This is an active prerequisite: if the shared file is missing, it directs execution of a generation command. That goes beyond the read-only mailbox summary and may create or update local skill files. The supplied source does not state the output locations, overwrite behavior, or generated content, so the exact file impact cannot be verified. A user can ask for the generated-file list and overwrite rules, or prohibit running the generator first.

SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Show 1 other places
SKILL.md:18In the instructionsOpen original file
Show unread inbox summary (sender, subject, date)
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The Skill instructs the agent to run `gws gmail +triage` to list the sender, subject, and date of unread Gmail messages, with a default maximum of 20.

View source
SKILL.md:18In the instructionsOpen original file
Show unread inbox summary (sender, subject, date)
SKILL.md:22In the instructionsOpen original file
```bashgws gmail +triage```
SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--max` | — | 20 | Maximum messages to show (default: 20) || `--query` | — | — | Gmail search query (default: is:unread) || `--labels` | — | — | Include label names in output |

The Skill depends on shared authentication and security rules that were not included in the evidence, and directs the agent to run a generation command if that shared file is absent. The supplied material does not permit verification of authentication scope, global flags, or the actual CLI implementation.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
SKILL.md:50In the instructionsOpen original file
- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth- [gws-gmail](../gws-gmail/SKILL.md) — All send, read, and manage email commands

The documentation claims the command is read-only and never modifies the mailbox, but the evidence contains only the instruction file and no script or CLI source with which to independently verify that claim.

View source
SKILL.md:43In the instructionsOpen original file
## Tips- Read-only — never modifies your mailbox.- Defaults to table output format.
Start here · InstructionsSKILL.md
gws-gmail-triage
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws gmail +triage
SKILL.md:36In the instructionsOpen original file
```bashgws gmail +triage
Lines read
52
File checksum (to compare versions)
293f4d3e8a0717e91674929fcff2c79d541cb2ebfb60ef816c350a6f3d01a46f