Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Create Gmail Filter Skill Security Audit

What the author says it does (original text)

Create a Gmail filter to automatically label, star, or categorize incoming messages.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The example filter removes matching mail from the inbox beyond the stated labeling, starring, or categorization behavior

Source references: 2
What we found

The filter action adds a label but also removes the `INBOX` label, automatically archiving new mail from the matching sender. The Skill description does not disclose that messages will leave the inbox.

Why this matters

Receipts, payment notices, or other important messages may no longer appear in the inbox, potentially causing the user to miss refund deadlines, payment problems, or required actions. The mail would ordinarily remain in the account but become less visible.

The stated purpose is to label, star, or categorize incoming mail, but the live filter-creation command also places `INBOX` in `removeLabelIds`. If a user adopts the example, matching mail from `receipts@example.com` will leave the inbox (be archived), reducing visibility and potentially causing missed messages. The user can ask the author to disclose this behavior and require that `INBOX` not be removed unless archiving is explicitly authorized.

SKILL.md:3In the instructionsOpen original file
name: recipe-create-gmail-filterdescription: "Create a Gmail filter to automatically label, star, or categorize incoming messages."metadata:
Show 1 other places
SKILL.md:26In the instructionsOpen original file
2. Create a new label: `gws gmail users labels create --params '{"userId": "me"}' --json '{"name": "Receipts"}'`3. Create a filter: `gws gmail users settings filters create --params '{"userId": "me"}' --json '{"criteria": {"from": "receipts@example.com"}, "action": {"addLabelIds": ["LABEL_ID"], "removeLabelIds": ["INBOX"]}}'`4. Verify filter: `gws gmail users settings filters list --params '{"userId": "me"}' --format table`

Inside this skill

1 instruction sections

The Skill requires `gws-gmail` and uses `gws` commands to operate on the currently authenticated user's (`userId: "me"`) Gmail settings.

View source
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-gmail`
SKILL.md:24In the instructionsOpen original file
1. List existing labels: `gws gmail users labels list --params '{"userId": "me"}' --format table`2. Create a new label: `gws gmail users labels create --params '{"userId": "me"}' --json '{"name": "Receipts"}'`

The workflow creates a persistent Gmail label named “Receipts,” then creates and lists filters for verification. `LABEL_ID` in the filter is a placeholder that must be replaced with a real label ID.

View source
SKILL.md:25In the instructionsOpen original file
1. List existing labels: `gws gmail users labels list --params '{"userId": "me"}' --format table`2. Create a new label: `gws gmail users labels create --params '{"userId": "me"}' --json '{"name": "Receipts"}'`3. Create a filter: `gws gmail users settings filters create --params '{"userId": "me"}' --json '{"criteria": {"from": "receipts@example.com"}, "action": {"addLabelIds": ["LABEL_ID"], "removeLabelIds": ["INBOX"]}}'`
SKILL.md:26In the instructionsOpen original file
2. Create a new label: `gws gmail users labels create --params '{"userId": "me"}' --json '{"name": "Receipts"}'`3. Create a filter: `gws gmail users settings filters create --params '{"userId": "me"}' --json '{"criteria": {"from": "receipts@example.com"}, "action": {"addLabelIds": ["LABEL_ID"], "removeLabelIds": ["INBOX"]}}'`4. Verify filter: `gws gmail users settings filters list --params '{"userId": "me"}' --format table`
SKILL.md:27In the instructionsOpen original file
3. Create a filter: `gws gmail users settings filters create --params '{"userId": "me"}' --json '{"criteria": {"from": "receipts@example.com"}, "action": {"addLabelIds": ["LABEL_ID"], "removeLabelIds": ["INBOX"]}}'`4. Verify filter: `gws gmail users settings filters list --params '{"userId": "me"}' --format table`
Start here · InstructionsSKILL.md
recipe-create-gmail-filter
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
29
File checksum (to compare versions)
d32fe46464372c6a5f6f5e55cc6a2ed81c10f9b6c17894665ec8f863bfeb378a