Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Label And Archive Emails Skill Security Audit

What the author says it does (original text)

Apply Gmail labels to matching messages and archive them to keep your inbox clean.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Gmail messages are modified and archived without requiring confirmation of the matches

Source references: 4
What we found

After searching, the workflow immediately directs two write operations. It does not require showing the user the final query, match count, or message samples, or obtaining explicit approval before archiving. Labeling and archiving are also separate operations, so interruption can leave only one completed.

Why this matters

If the query, `MESSAGE_ID`, or `LABEL_ID` is substituted incorrectly, unintended messages may be misclassified and removed from the inbox, causing the user to miss them. Archiving is generally reversible, but the user may not notice promptly.

These are active workflow instructions: after searching, they directly tell the agent to add a label and remove INBOX from a specified MESSAGE_ID, without a preview or pre-write confirmation step. If an agent substitutes a broad query and processes its results, messages the user has not reviewed could be archived; because the two modifications are separate, interruption could also leave only the label applied. Archiving is the skill’s stated purpose, not concealed behavior, but users can ask for result counts/samples, explicit confirmation, and recovery guidance.

SKILL.md:24In the instructionsOpen original file
1. Search for matching emails: `gws gmail users messages list --params '{"userId": "me", "q": "from:notifications@service.com"}' --format table`2. Apply a label: `gws gmail users messages modify --params '{"userId": "me", "id": "MESSAGE_ID"}' --json '{"addLabelIds": ["LABEL_ID"]}'`3. Archive (remove from inbox): `gws gmail users messages modify --params '{"userId": "me", "id": "MESSAGE_ID"}' --json '{"removeLabelIds": ["INBOX"]}'`
Show 3 other places
SKILL.md:20In the instructionsOpen original file
Apply Gmail labels to matching messages and archive them to keep your inbox clean.
SKILL.md:25In the instructionsOpen original file
1. Search for matching emails: `gws gmail users messages list --params '{"userId": "me", "q": "from:notifications@service.com"}' --format table`2. Apply a label: `gws gmail users messages modify --params '{"userId": "me", "id": "MESSAGE_ID"}' --json '{"addLabelIds": ["LABEL_ID"]}'`3. Archive (remove from inbox): `gws gmail users messages modify --params '{"userId": "me", "id": "MESSAGE_ID"}' --json '{"removeLabelIds": ["INBOX"]}'`
SKILL.md:26In the instructionsOpen original file
2. Apply a label: `gws gmail users messages modify --params '{"userId": "me", "id": "MESSAGE_ID"}' --json '{"addLabelIds": ["LABEL_ID"]}'`3. Archive (remove from inbox): `gws gmail users messages modify --params '{"userId": "me", "id": "MESSAGE_ID"}' --json '{"removeLabelIds": ["INBOX"]}'`
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This Skill requires `gws-gmail` and uses `gws` to search Gmail messages, add a label, and then archive them by removing the `INBOX` label.

View source
SKILL.md:18In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-gmail`
SKILL.md:24In the instructionsOpen original file
1. Search for matching emails: `gws gmail users messages list --params '{"userId": "me", "q": "from:notifications@service.com"}' --format table`2. Apply a label: `gws gmail users messages modify --params '{"userId": "me", "id": "MESSAGE_ID"}' --json '{"addLabelIds": ["LABEL_ID"]}'`3. Archive (remove from inbox): `gws gmail users messages modify --params '{"userId": "me", "id": "MESSAGE_ID"}' --json '{"removeLabelIds": ["INBOX"]}'`
Start here · InstructionsSKILL.md
recipe-label-and-archive-emails
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
28
File checksum (to compare versions)
d6500516ec59ffab9be8d3bbf388ce9af59dff4bda380e297b2286f0e5d13414