Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Gws Drive Upload Skill Security Audit

What the author says it does (original text)

Google Drive: Upload a file with automatic metadata.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Uploading discloses the local file and its name to the connected Google Drive account

Source references: 6
What we found

The command accepts any local file path and uploads it, retaining the source filename by default. The confirmation warning reduces accidental use, but the supplied source shows no content inspection, sensitive-data filtering, or destination-account verification.

Why this matters

If the user or agent selects the wrong file, Google account, or parent folder, the contents and potentially sensitive filename enter the wrong cloud location and become subject to that location's sharing, retention, and access rules.

The skill explicitly uploads a user-specified local file to Google Drive and uses the source filename by default, so execution transfers the file contents and filename into the currently authenticated Drive account. This matches the stated purpose and is not evidence of malicious behavior; the documentation also requires user confirmation. However, the shown instructions do not require checking the destination account or reviewing sensitive content. A user can require confirmation of the local path, account, parent folder, and remote filename, and authorize only specifically selected files.

SKILL.md:23In the instructionsOpen original file
```bashgws drive +upload <file>```
Show 5 other places
SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `<file>` | ✓ | — | Path to file to upload || `--parent` | — | — | Parent folder ID || `--name` | — | — | Target filename (defaults to source filename) |
SKILL.md:45In the instructionsOpen original file
- MIME type is detected automatically.- Filename is inferred from the local path unless --name is given.
SKILL.md:47In the instructionsOpen original file
> [!CAUTION]> This is a **write** command — confirm with the user before executing.
SKILL.md:22In the instructionsOpen original file
```bashgws drive +upload <file>```
SKILL.md:28In the instructionsOpen original file
| Flag | Required | Default | Description ||------|----------|---------|-------------|| `<file>` | ✓ | — | Path to file to upload || `--parent` | — | — | Parent folder ID || `--name` | — | — | Target filename (defaults to source filename) |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The Skill calls `gws drive +upload` to upload a user-selected local file to Google Drive, with optional destination-folder and remote-name settings.

View source
SKILL.md:23In the instructionsOpen original file
```bashgws drive +upload <file>```
SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `<file>` | ✓ | — | Path to file to upload || `--parent` | — | — | Parent folder ID || `--name` | — | — | Target filename (defaults to source filename) |

The documentation explicitly classifies uploading as a write operation and requires user confirmation before execution; this control is effective only if the agent follows it.

View source
SKILL.md:47In the instructionsOpen original file
> [!CAUTION]> This is a **write** command — confirm with the user before executing.

The Skill depends on shared authentication and security rules that are not included in this submission. If that dependency is absent, it instructs the agent to run a generator, so authentication scope, global flags, and generated content cannot be audited from this source alone.

View source
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Start here · InstructionsSKILL.md
gws-drive-upload
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws drive +upload <file>
SKILL.md:36In the instructionsOpen original file
```bashgws drive +upload ./report.pdf
Lines read
54
File checksum (to compare versions)
7f678b8d8f6c5335b029086912ddebf72566dd0f34ac8596e9ce1718a372ce7e