Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Chat Skill Security Audit

What the author says it does (original text)

Google Chat: Manage Chat spaces and messages.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Administrator mode can enumerate Chat spaces across an organization

Source references: 3
What we found

The Skill exposes organization-wide space search and explicitly directs use of `use_admin_access=true`. The supplied source does not constrain the permitted organization scope, purpose, or handling of the results.

Why this matters

If the agent has administrator authorization and uses this method for an unnecessary task, it can reveal space names and related metadata that the user would not ordinarily see. Handling of those results depends on shared rules not provided here.

Legitimate use of this code

This line documents Google Chat's administrator search API and explicitly says `use_admin_access` must be enabled; it does not instruct default, covert, or unauthorized enumeration. Organization-wide search fits the stated purpose of managing Chat spaces, and actual access depends on the authenticated account's administrator permissions. The lack of purpose or result-handling rules in this catalog entry alone does not establish misuse.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:51In the instructionsOpen original file
  - `patch` — Updates a space. For an example, see [Update a space](https://developers.google.com/workspace/chat/update-spaces). If you're updating the `displayName` field and receive the error message `ALREADY_EXISTS`, try a different display name.. An existing space within the Google Workspace organization might already use this display name.  - `search` — Returns a list of spaces in a Google Workspace organization based on an administrator's search. In the request, set `use_admin_access` to `true`. For an example, see [Search for and manage spaces](https://developers.google.com/workspace/chat/search-manage-admin).  - `setup` — Creates a space and adds specified users to it. The calling user is automatically added to the space, and shouldn't be specified as a membership in the request. For an example, see [Set up a space with initial members](https://developers.google.com/workspace/chat/set-up-spaces). To specify the human members to add, add memberships with the appropriate `membership.member.name`. To add a human user, use `users/{user}`, where `{user}` can be the email address for the user.
Show 2 other places
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
SKILL.md:3In the instructionsOpen original file
name: gws-chatdescription: "Google Chat: Manage Chat spaces and messages."metadata:
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
High risk

Deleting a space cascades to its messages and memberships

Source references: 3
What we found

The Skill explicitly exposes space deletion and states that child resources are deleted with it. The supplied local rules require parameter inspection but do not show a target preview or explicit user-confirmation requirement for deletion.

Why this matters

If the wrong space is selected, or an ambiguous request to “clean up” or “manage” spaces is interpreted as deletion, the named space, its messages, and its memberships can all be removed.

What this evidence establishes

The source confirms that `spaces.delete` cascades to messages and memberships, so an actual call could cause irreversible data loss. However, this is an API method catalog and does not direct automatic deletion. It also requires security rules from another file that was not provided, so the claimed absence of target preview or explicit confirmation cannot be established. A user can ask the author to supply and explain those shared deletion safeguards.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:46In the instructionsOpen original file
  - `create` — Creates a space. Can be used to create a named space, or a group chat in `Import mode`. For an example, see [Create a space](https://developers.google.com/workspace/chat/create-spaces).  - `delete` — Deletes a named space. Always performs a cascading delete, which means that the space's child resources—like messages posted in the space and memberships in the space—are also deleted. For an example, see [Delete a space](https://developers.google.com/workspace/chat/delete-spaces).  - `findDirectMessage` — Returns the existing direct message with the specified user. If no direct message space is found, returns a `404 NOT_FOUND` error. For an example, see [Find a direct message](/chat/api/guides/v1/spaces/find-direct-message). With [app authentication](https://developers.google.com/workspace/chat/authenticate-authorize-chat-app), returns the direct message space between the specified user and the calling Chat app.
Show 2 other places
SKILL.md:64In the instructionsOpen original file
Before calling any API method, inspect it:```bash# Browse resources and methodsgws chat --help# Inspect a method's required params, types, and defaultsgws schema chat.<resource>.<method>```Use `gws schema` output to build your `--params` and `--json` flags.
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This Skill is a command catalog for the Google Chat CLI; it tells the agent to inspect each API method's parameters and defaults before calling it.

View source
SKILL.md:64In the instructionsOpen original file
Before calling any API method, inspect it:```bash# Browse resources and methodsgws chat --help# Inspect a method's required params, types, and defaultsgws schema chat.<resource>.<method>```Use `gws schema` output to build your `--params` and `--json` flags.

Authentication, global flags, and security rules are outside the supplied source. This Skill depends on a neighboring shared Skill and instructs the agent to generate it if absent, so the provided material does not show credential scope, confirmation controls, or which files generation writes.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.

The exposed operation set extends beyond messages to media transfer, space creation and modification, membership operations, organization-wide space search, and custom-emoji management.

View source
SKILL.md:39In the instructionsOpen original file
  - `download` — Downloads media. Download is supported on the URI `/v1/media/{+name}?alt=media`.  - `upload` — Uploads an attachment. For an example, see [Upload media as a file attachment](https://developers.google.com/workspace/chat/upload-media-attachments).
SKILL.md:50In the instructionsOpen original file
  - `list` — Lists spaces the caller is a member of. Group chats and DMs aren't listed until the first message is sent. For an example, see [List spaces](https://developers.google.com/workspace/chat/list-spaces).  - `patch` — Updates a space. For an example, see [Update a space](https://developers.google.com/workspace/chat/update-spaces). If you're updating the `displayName` field and receive the error message `ALREADY_EXISTS`, try a different display name.. An existing space within the Google Workspace organization might already use this display name.  - `search` — Returns a list of spaces in a Google Workspace organization based on an administrator's search. In the request, set `use_admin_access` to `true`. For an example, see [Search for and manage spaces](https://developers.google.com/workspace/chat/search-manage-admin).  - `setup` — Creates a space and adds specified users to it. The calling user is automatically added to the space, and shouldn't be specified as a membership in the request. For an example, see [Set up a space with initial members](https://developers.google.com/workspace/chat/set-up-spaces). To specify the human members to add, add memberships with the appropriate `membership.member.name`. To add a human user, use `users/{user}`, where `{user}` can be the email address for the user.  - `members` — Operations on the 'members' resource  - `messages` — Operations on the 'messages' resource
Start here · InstructionsSKILL.md
gws-chat
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:18In the instructionsOpen original file
```bashgws chat <resource> <method> [flags]
SKILL.md:66In the instructionsOpen original file
```bash# Browse resources and methods
Connect to websites
SKILL.md:32In the instructionsOpen original file
  - `create` — Creates a custom emoji. Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization. For more information, see [Learn about custom emojis in Google Chat](https://support.google.com/chat/answer/12800149) and [Manage custom emoji permissions](https://support.google.com/a/answer/12850085).  - `delete` — Deletes a custom emoji. By default, users can only delete custom emoji they created. [Emoji managers](https://support.google.com/a/answer/12850085) assigned by the administrator can delete any custom emoji in the organization …
SKILL.md:33In the instructionsOpen original file
  - `create` — Creates a custom emoji. Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization. For more information, see [Learn about custom emojis in Google Cha …  - `delete` — Deletes a custom emoji. By default, users can only delete custom emoji they created. [Emoji managers](https://support.google.com/a/answer/12850085) assigned by the administrator can delete any custom emoji in the organization. See [Learn about custom emojis in Google Chat](https://support.google.com/chat/answer/12800149). Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization.  - `get` — Returns details about a custom emoji. Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization. For more information, see [Learn about custom emojis in …
SKILL.md:34In the instructionsOpen original file
  - `delete` — Deletes a custom emoji. By default, users can only delete custom emoji they created. [Emoji managers](https://support.google.com/a/answer/12850085) assigned by the administrator can delete any custom emoji in the organization …  - `get` — Returns details about a custom emoji. Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization. For more information, see [Learn about custom emojis in Google Chat](https://support.google.com/chat/answer/12800149) and [Manage custom emoji permissions](https://support.google.com/a/answer/12850085).  - `list` — Lists custom emojis visible to the authenticated user. Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization. For more information, see [Learn abou …
Lines read
76
File checksum (to compare versions)
e9b62111b4b5b8403de075e4c3ae8681b0c0e58996508cc9253641709c36b535