Gws Gmail Read

Gmail: Read a message and extract its body or headers.

Security Scan

The skill is a thin wrapper around the 'gws' CLI to read Gmail (which is coherent) but it silently depends on a separate shared SKILL.md for authentication and global flags and does not declare any credentials or config paths — review the referenced shared file and the gws client before using.

Purpose & Capability

The declared purpose (read Gmail) matches the required binary 'gws' and the runtime examples. However the SKILL.md points to ../gws-shared/SKILL.md for auth/global flags; the registry metadata lists no required env vars or config paths. That is an inconsistency: authentication requirements are implied but not declared.

Instruction Scope

The instructions themselves simply call the gws CLI to read a message, which is in-scope. But they explicitly instruct the agent to read an external file (../gws-shared/SKILL.md) for auth and security rules. That external dependency is not present in the package metadata and may contain instructions to access credentials, config paths, or other system state — the runtime behavior is therefore underspecified and potentially broader than advertised.

Install Mechanism

This is an instruction-only skill with no install spec and no code files. Nothing is written to disk by the skill itself. Risk depends on the external 'gws' binary (not supplied here) rather than the skill bundle.

Credentials

The skill declares no required environment variables or credentials, yet it depends on authentication provided by a separate shared SKILL.md. Expect that OAuth tokens, service-account keys, or other credentials are required in practice; those credentials are not documented in this skill, which is disproportionate and opaque.

Persistence & Privilege

The skill does not request always:true, does not modify other skills' configs in the bundle, and is user-invocable only. Autonomous invocation is allowed (platform default) but there is no extra persistence or elevated privilege declared by this skill itself.

What to consider before installing

This skill itself is just documentation for the 'gws' CLI, but it defers authentication details to ../gws-shared/SKILL.md which is not included or declared. Before installing or enabling: (1) locate and read the referenced gws-shared SKILL.md to see exactly how credentials are provided and what env vars or config paths are used; (2) verify the 'gws' binary is trusted and from a reputable source; (3) confirm the OAuth/service-account scopes and ensure least privilege (only read-mail if that's all you need); (4) ensure the agent will not be granted broad filesystem access that would expose other credentials; (5) if you cannot inspect the referenced shared file or the gws client, treat this as a red flag and do not enable the skill. If you want higher assurance, request the publisher to include explicit declarations of required env vars/config paths and to bundle or reference a verified gws release URL.

gmail +read

PREREQUISITE: Read ../gws-shared/SKILL.md for auth, global flags, and security rules. If missing, run gws generate-skills to create it.

Read a message and extract its body or headers

Usage

gws gmail +read --id <ID>

Flags

Flag	Required	Default	Description
--id	✓	—	The Gmail message ID to read
--headers	—	—	Include headers (From, To, Subject, Date) in the output
--format	—	text	Output format (text, json)
--html	—	—	Return HTML body instead of plain text
--dry-run	—	—	Show the request that would be sent without executing it

Examples

gws gmail +read --id 18f1a2b3c4d
gws gmail +read --id 18f1a2b3c4d --headers
gws gmail +read --id 18f1a2b3c4d --format json | jq '.body'

Tips

• Converts HTML-only messages to plain text automatically.
• Handles multipart/alternative and base64 decoding.

See Also

• gws-shared — Global flags and auth
• gws-gmail — All send, read, and manage email commands