gmail-all-email-actions

Referenced artifact was not completely inspected

The skill description emphasizes broad Gmail control but does not prominently warn that it can perform destructive actions and access sensitive communications. Missing consent and risk language is dangerous here because users may invoke the skill without realizing it can exfiltrate private email content, send messages, or delete/trash data.

The activation keywords include broad phrases like email management and information gathering, making accidental or overly eager activation more likely. In a skill with capabilities to read, send, forward, trash, and label email, overbroad triggering increases the chance of unintended access to sensitive messages or unintended outbound actions.

The skill instructs users to run npx skills ... without pinning an exact package version or integrity. That creates a supply-chain risk: a future compromised or breaking package release could be fetched and executed during installation, which is especially concerning because this skill is for privileged Gmail operations.

This line again recommends npx skills without version pinning, allowing unreviewed code to be downloaded and executed at install time. In the context of an email-management skill, compromise of the installer path could lead to credential theft or malicious tool substitution.

The unpinned npx skills invocation exposes users to dependency substitution or a malicious upstream release. Because the skill enables access to inbox contents and outbound mail, a compromised install chain could materially impact confidentiality and account integrity.

This duplicated unpinned install command has the same supply-chain exposure as the other instances. Attackers who compromise the package or namespace could deliver arbitrary code during installation before the user ever reaches the Gmail tool itself.

The install instruction uses npx without constraining the package version, which is a known unsafe pattern for setup documentation. In a skill that brokers access to email data and sending authority, supply-chain compromise can amplify downstream account abuse.

An additional unpinned npx skills command repeats the same supply-chain vulnerability. Users following these instructions may execute whatever package version is current at the time, including a malicious or tampered release.

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

The schema exposes permanently destructive operations such as draft deletion without any documented confirmation, safety interlock, or explicit user-consent guidance. In an agentic context, this increases the chance of accidental or unauthorized data loss because an agent may invoke the action directly from ambiguous instructions or prompt-manipulated input.

The outgoing email actions allow transmission of message bodies, recipients, and fetched attachments from public URLs, but the schema provides no warning about privacy, recipient verification, attachment provenance, or the risk of sending sensitive data externally. In an agent-enabled workflow, this can lead to unintended disclosure, spoofed communications via send-as aliases, or exfiltration of sensitive content through mistaken or manipulated sends.

The skill's documentation presents a concrete action inventory under 'Actions' but does not include get_thread, while later sections explicitly list get_thread as a supported action with its own schema entry. This is an intent/documentation inconsistency within the skill file about what the tool exposes.