Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Create Vacation Responder Skill Security Audit

What the author says it does (original text)

Enable a Gmail out-of-office auto-reply with a custom message and date range.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Auto-replies are explicitly allowed for senders outside contacts and the organization domain

Source references: 1
What we found

The enable command sets both `restrictToContacts` and `restrictToDomain` to `false`, while the message discloses the user's absence, an expected date, and a backup email address.

Why this matters

External or unknown senders who trigger a reply may learn about staff absence and an internal contact path, increasing targeted phishing, impersonation, or harassment risk.

The enable step explicitly turns off both the contacts and domain restrictions, so replies may go to senders outside the user's contacts and organization. The body would disclose absence status, a date statement, and a backup email to those external senders. This risk arises only if the command is executed and Gmail receives mail eligible for an automatic reply. A user can ask for restrictive defaults and mandatory confirmation of placeholder identity details.

SKILL.md:24In the instructionsOpen original file
1. Enable vacation responder: `gws gmail users settings updateVacation --params '{"userId": "me"}' --json '{"enableAutoReply": true, "responseSubject": "Out of Office", "responseBodyPlainText": "I am out of the office until Jan 20. For urgent matters, contact backup@company.com.", "restrictToContacts": false, "restrictToDomain": false}'`2. Verify settings: `gws gmail users settings getVacation --params '{"userId": "me"}'`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The command does not implement the claimed custom date range and may send stale or incorrect information

Source references: 3
What we found

The Skill claims a custom message and date range, but the enable parameters contain no start or end time—only hard-coded “Jan 20” and `backup@company.com`; stopping depends on the user separately running step 3 after returning.

Why this matters

Executing it as written may immediately send replies with a wrong date or contact and continue until manually disabled, misleading customers, coworkers, or partners and misrouting urgent matters.

The Skill claims a custom date range, but the enable command contains no date fields; “Jan 20” is only hard-coded message text and does not schedule deactivation. The workflow relies on a separate command when the user returns, so forgetting it could leave stale absence information active, and the example backup address could be sent without replacement. A user can ask for real start/end parameters where supported, confirmation of message content, and verification of scheduled deactivation.

SKILL.md:3In the instructionsOpen original file
name: recipe-create-vacation-responderdescription: "Enable a Gmail out-of-office auto-reply with a custom message and date range."metadata:
Show 2 other places
SKILL.md:24In the instructionsOpen original file
1. Enable vacation responder: `gws gmail users settings updateVacation --params '{"userId": "me"}' --json '{"enableAutoReply": true, "responseSubject": "Out of Office", "responseBodyPlainText": "I am out of the office until Jan 20. For urgent matters, contact backup@company.com.", "restrictToContacts": false, "restrictToDomain": false}'`2. Verify settings: `gws gmail users settings getVacation --params '{"userId": "me"}'`
SKILL.md:26In the instructionsOpen original file
2. Verify settings: `gws gmail users settings getVacation --params '{"userId": "me"}'`3. Disable when back: `gws gmail users settings updateVacation --params '{"userId": "me"}' --json '{"enableAutoReply": false}'`

Inside this skill

1 instruction sections

The Skill requires `gws-gmail`, then enables, reads, and eventually disables the vacation responder for the currently authenticated Gmail user (`userId: "me"`).

View source
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-gmail`
SKILL.md:24In the instructionsOpen original file
1. Enable vacation responder: `gws gmail users settings updateVacation --params '{"userId": "me"}' --json '{"enableAutoReply": true, "responseSubject": "Out of Office", "responseBodyPlainText": "I am out of the office until Jan 20. For urgent matters, contact backup@company.com.", "restrictToContacts": false, "restrictToDomain": false}'`2. Verify settings: `gws gmail users settings getVacation --params '{"userId": "me"}'`3. Disable when back: `gws gmail users settings updateVacation --params '{"userId": "me"}' --json '{"enableAutoReply": false}'`

The enable command uses a fixed subject, return date, and backup contact instead of first collecting the user's intended content.

View source
SKILL.md:24In the instructionsOpen original file
1. Enable vacation responder: `gws gmail users settings updateVacation --params '{"userId": "me"}' --json '{"enableAutoReply": true, "responseSubject": "Out of Office", "responseBodyPlainText": "I am out of the office until Jan 20. For urgent matters, contact backup@company.com.", "restrictToContacts": false, "restrictToDomain": false}'`2. Verify settings: `gws gmail users settings getVacation --params '{"userId": "me"}'`
Start here · InstructionsSKILL.md
recipe-create-vacation-responder
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
21156bfe772789f03fe68a3385a6a17a1c2f5c091c9e1a69d9a5eca227933746