Skip to content
skillsafebeta
← Report library
Purpose / Other

Recipe Save Email Attachments Skill Security Audit

What the author says it does (original text)

Find Gmail messages with attachments and save them to a Google Drive folder.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The download and upload steps are not explicitly connected, risking upload of the wrong local file

Source references: 2
What we found

The attachment command does not specify that its result is saved as `./attachment.pdf`, while the next step unconditionally uploads that path. The provided instructions do not establish that the uploaded file is the downloaded attachment.

Why this matters

If a same-named file already exists in the working directory, an unrelated or sensitive local PDF could be uploaded to the selected Drive folder; if it does not exist, the workflow may fail.

These are active recipe steps, not a warning example. Step 3 retrieves an attachment but does not state that its output is written to `./attachment.pdf`; step 4 then uploads that fixed local path. If the file was not created by this download, is stale, or contains other data, the wrong or sensitive local file could be uploaded to Drive. The user can ask the author to specify the download output and file-writing step and require verification of the file's path, origin, and contents before upload.

SKILL.md:27In the instructionsOpen original file
2. Get message details: `gws gmail users messages get --params '{"userId": "me", "id": "MESSAGE_ID"}'`3. Download attachment: `gws gmail users messages attachments get --params '{"userId": "me", "messageId": "MESSAGE_ID", "id": "ATTACHMENT_ID"}'`4. Upload to Drive folder: `gws drive +upload --file ./attachment.pdf --parent FOLDER_ID`
Show 1 other places
SKILL.md:28In the instructionsOpen original file
3. Download attachment: `gws gmail users messages attachments get --params '{"userId": "me", "messageId": "MESSAGE_ID", "id": "ATTACHMENT_ID"}'`4. Upload to Drive folder: `gws drive +upload --file ./attachment.pdf --parent FOLDER_ID`
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The recipe requires two external skills that are not included in the source and uses `gws` to access Gmail and Google Drive; how those dependencies handle credentials, downloaded data, and network requests cannot be audited from this material.

View source
SKILL.md:19In the instructionsOpen original file
> **PREREQUISITE:** Load the following skills to execute this recipe: `gws-gmail`, `gws-drive`

Its stated workflow searches Gmail for messages with attachments, retrieves message details, downloads an attachment, and then uploads a local file to a specified Drive folder.

View source
SKILL.md:25In the instructionsOpen original file
1. Search for emails with attachments: `gws gmail users messages list --params '{"userId": "me", "q": "has:attachment from:client@example.com"}' --format table`2. Get message details: `gws gmail users messages get --params '{"userId": "me", "id": "MESSAGE_ID"}'`3. Download attachment: `gws gmail users messages attachments get --params '{"userId": "me", "messageId": "MESSAGE_ID", "id": "ATTACHMENT_ID"}'`4. Upload to Drive folder: `gws drive +upload --file ./attachment.pdf --parent FOLDER_ID`
Start here · InstructionsSKILL.md
recipe-save-email-attachments
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
30
File checksum (to compare versions)
3fce70810e34b347a088f177b86221bf408b9a16a12a8078eb8245e84f781201