Skip to content

fix(gmail): add HTML draft creation guidance to generated skill #568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kleinq wants to merge 1 commit into
base: main
Choose a base branch
from
+34 −0
Open

fix(gmail): add HTML draft creation guidance to generated skill #568

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions src/generate_skills.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -474,6 +474,40 @@ metadata:
}
}

// Gmail-specific: explain how to create properly formatted drafts
if alias == "gmail" {
out.push_str("## Creating Drafts\n\n");
out.push_str("**Always use HTML when creating drafts** to prevent email clients from wrapping long lines. Build the raw RFC 2822 message with `Content-Type: text/html` and convert the plain text body to HTML:\n\n");
out.push_str("- Double newlines → paragraph breaks (`<div>...</div>` separated by `<div><br></div>`)\n");
out.push_str("- Single newlines → `<br>`\n");
out.push_str("- Wrap in `<div dir=\"ltr\">...</div>`\n\n");
out.push_str("```bash\n");
out.push_str("python3 - <<'PYEOF'\n");
out.push_str("import base64\n\n");
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

To support the suggested fix for XSS in the html_parts generation, the html module needs to be imported. Please add import html at the beginning of the Python snippet.

Suggested change
out.push_str("import base64\n\n");
import base64
import html

out.push_str("to = \"recipient@example.com\"\n");
out.push_str("subject = \"Your Subject\"\n");
out.push_str("body = \"\"\"Paragraph one line one.\\nStill paragraph one.\\n\\nParagraph two.\"\"\"\n\n");
out.push_str("paragraphs = body.split('\\n\\n')\n");
out.push_str("html_parts = ['<div>' + p.replace('\\n', '<br>').strip() + '</div>' for p in paragraphs]\n");
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The Python snippet constructs HTML by directly inserting the body content without proper HTML escaping. If the body variable contains malicious HTML or script tags (e.g., <script>alert('XSS')</script>), this could lead to a Cross-Site Scripting (XSS) vulnerability when the email is viewed by a recipient. It's crucial to HTML-escape any user-provided text that will be rendered as HTML to prevent such attacks.

To fix this, you should escape the p variable before concatenating it into the div tag. Python's html module (specifically html.escape) can be used for this purpose. Alternatively, if using a templating engine, it would handle escaping automatically.

For example, you could modify the line to include html.escape(p):

import html
# ... other code ...
html_parts = ['<div>' + html.escape(p.replace('\n', '<br>').strip()) + '</div>' for p in paragraphs]
Suggested change
out.push_str("html_parts = ['<div>' + p.replace('\\n', '<br>').strip() + '</div>' for p in paragraphs]\n");
html_parts = ['<div>' + html.escape(p.replace('\n', '<br>').strip()) + '</div>' for p in paragraphs]
References
  1. Sanitize error strings printed to the terminal to prevent escape sequence injection.

out.push_str("html_body = '<div dir=\"ltr\">' + '<div><br></div>'.join(html_parts) + '</div>'\n\n");
out.push_str("raw = '\\r\\n'.join([\n");
out.push_str(" f'To: {to}',\n");
out.push_str(" f'Subject: {subject}',\n");
out.push_str(" 'MIME-Version: 1.0',\n");
out.push_str(" 'Content-Type: text/html; charset=utf-8',\n");
out.push_str(" '',\n");
out.push_str(" html_body,\n");
out.push_str("])\n");
out.push_str("encoded = base64.urlsafe_b64encode(raw.encode('utf-8')).decode('ascii').rstrip('=')\n");
out.push_str("print(encoded)\n");
out.push_str("PYEOF\n");
out.push_str("```\n\n");
out.push_str("Then create the draft:\n\n");
out.push_str("```bash\n");
out.push_str("gws gmail users drafts create --json '{\"message\":{\"raw\":\"ENCODED_OUTPUT_FROM_ABOVE\"}}'\n");
out.push_str("```\n\n");
out.push_str("To reply in-thread, add `\"threadId\"` to the message object and include `In-Reply-To` / `References` headers.\n\n");
}
// Discovering commands section
out.push_str("## Discovering Commands\n\n");
out.push_str("Before calling any API method, inspect it:\n\n");
Expand Down
Loading