Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Gmail Watch Skill Security Audit

What the author says it does (original text)

Gmail: Watch for new emails and stream them as NDJSON.

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

New email is streamed in full format by default

Source references: 2
What we found

The default message format is `full`, and the command streams new email as NDJSON. Full messages may contain bodies, senders, recipients, and other private material; terminal capture, agent context, or pipeline logging may retain it.

Why this matters

Email content may become visible on screen, in logs, to the command caller, or to other programs consuming the stream, widening access to sensitive correspondence.

The documented purpose is to stream new emails as NDJSON, and `--msg-format` defaults to `full`. If the user runs the command without choosing metadata or minimal output, complete message data may therefore reach the terminal, caller, or associated logs. This is consistent with the watch feature, but plausibly increases exposure of private email content; the evidence does not show that anything was logged or exfiltrated.

SKILL.md:18In the instructionsOpen original file
Watch for new emails and stream them as NDJSON
Show 1 other places
SKILL.md:36In the instructionsOpen original file
| `--poll-interval` | — | 5 | Seconds between pulls || `--msg-format` | — | full | Gmail message format: full, metadata, minimal, raw || `--once` | — | — | Pull once and exit |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Each email can be persisted as a separate local JSON file

Source references: 3
What we found

`--output-dir` writes every message into the selected directory, and the example uses `./emails`. These files may contain full email content, while the documentation does not state file permissions, encryption, automatic cleanup, or duplicate-file behavior.

Why this matters

Email copies may remain in the workspace and later be backed up, synchronized, indexed, committed to version control, or read by other parties with access to the device.

`--output-dir` is an optional, user-selected feature rather than a default write. When enabled, the documentation says each message is written as a separate JSON file and demonstrates `./emails`. If the format remains the default `full`, those files may contain complete messages and become subject to the directory's access, backup, and retention policies. The excerpt does not prove insecure permissions or describe overwrite/deduplication behavior.

SKILL.md:36In the instructionsOpen original file
| `--poll-interval` | — | 5 | Seconds between pulls || `--msg-format` | — | full | Gmail message format: full, metadata, minimal, raw || `--once` | — | — | Pull once and exit |
Show 2 other places
SKILL.md:39In the instructionsOpen original file
| `--cleanup` | — | — | Delete created Pub/Sub resources on exit || `--output-dir` | — | — | Write each message to a separate JSON file in this directory |
SKILL.md:47In the instructionsOpen original file
gws gmail +watch --subscription projects/p/subscriptions/my-subgws gmail +watch --project my-project --cleanup --output-dir ./emails```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Created cloud Pub/Sub resources persist by default

Source references: 5
What we found

The documentation says `--cleanup` deletes created resources on exit and explicitly states that resources persist for reconnection without it. The topic also involves Gmail push permission.

Why this matters

After local watching stops, topics or subscriptions associated with Gmail push permission may remain in the cloud project, creating ongoing permission, administration, and potential cost exposure.

The documentation explicitly says created Pub/Sub resources are deleted on exit only with the optional `--cleanup` flag; otherwise they persist for reconnection. That persistence serves the Gmail watch feature, but can leave cloud resources consuming quota, incurring charges, or retaining push-related permissions. A user can require cleanup when reconnection is unnecessary or supply an already reviewed topic/subscription. The evidence does not show which resources were actually created or that costs occurred.

SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--project` | — | — | GCP project ID for Pub/Sub resources || `--subscription` | — | — | Existing Pub/Sub subscription name (skip setup) |
Show 4 other places
SKILL.md:32In the instructionsOpen original file
| `--subscription` | — | — | Existing Pub/Sub subscription name (skip setup) || `--topic` | — | — | Existing Pub/Sub topic with Gmail push permission already granted || `--label-ids` | — | — | Comma-separated Gmail label IDs to filter (e.g., INBOX,UNREAD) |
SKILL.md:38In the instructionsOpen original file
| `--once` | — | — | Pull once and exit || `--cleanup` | — | — | Delete created Pub/Sub resources on exit || `--output-dir` | — | — | Write each message to a separate JSON file in this directory |
SKILL.md:53In the instructionsOpen original file
- Gmail watch expires after 7 days — re-run to renew.- Without --cleanup, Pub/Sub resources persist for reconnection.- Press Ctrl-C to stop gracefully.
SKILL.md:31In the instructionsOpen original file
| `--project` | — | — | GCP project ID for Pub/Sub resources || `--subscription` | — | — | Existing Pub/Sub subscription name (skip setup) || `--topic` | — | — | Existing Pub/Sub topic with Gmail push permission already granted || `--label-ids` | — | — | Comma-separated Gmail label IDs to filter (e.g., INBOX,UNREAD) |
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The Skill invokes `gws gmail +watch` to continuously watch for new email and stream results as NDJSON; unless `--once` is used, the documentation does not describe an automatic stopping point.

View source
SKILL.md:18In the instructionsOpen original file
Watch for new emails and stream them as NDJSON
SKILL.md:23In the instructionsOpen original file
```bashgws gmail +watch```
SKILL.md:37In the instructionsOpen original file
| `--msg-format` | — | full | Gmail message format: full, metadata, minimal, raw || `--once` | — | — | Pull once and exit || `--cleanup` | — | — | Delete created Pub/Sub resources on exit |

The Skill delegates authentication, global flags, and security rules to a shared file that is not included in the evidence, and instructs users to run a generator if it is missing. The actual authentication scope, security rules, global flags, and generated content therefore cannot be audited from this submission alone.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
SKILL.md:58In the instructionsOpen original file
- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth- [gws-gmail](../gws-gmail/SKILL.md) — All send, read, and manage email commands
Start here · InstructionsSKILL.md
gws-gmail-watch
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws gmail +watch
SKILL.md:43In the instructionsOpen original file
```bashgws gmail +watch --project my-gcp-project
Lines read
60
File checksum (to compare versions)
6f18bf757d55efa688543d64f3ee19d972f14bd913571df62006dc81eb650095