Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Events Renew Skill Security Audit

What the author says it does (original text)

Google Workspace Events: Renew/reactivate Workspace Events subscriptions.

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Bulk or scheduled renewal can keep every matching subscription active without individual review

Source references: 6
What we found

`--all` renews every subscription within the time window, and the documentation recommends putting that operation in cron. The supplied material shows no step that lists matches, excludes unwanted subscriptions, or requires per-item confirmation before execution.

Why this matters

Old, mistakenly created, or no-longer-needed Workspace Events subscriptions may remain active and continue their previously configured event activity. A scheduled job can repeatedly extend that state.

What this evidence establishes

The documentation says that a user-selected `--all` operation renews every subscription in the window and recommends recurring execution through cron, so multiple subscriptions could be kept active over time. However, only usage documentation is provided, not the CLI implementation, so it does not establish whether matches are previewed, confirmation is requested, or exclusions are supported. Bulk renewal is also the flag's disclosed purpose, not hidden behavior. A user can ask the author to document preview/confirmation/filtering and restrict automation to explicit `--name` targets.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--name` | — | — | Subscription name to reactivate (e.g., subscriptions/SUB_ID) || `--all` | — | — | Renew all subscriptions expiring within --within window || `--within` | — | 1h | Time window for --all (e.g., 1h, 30m, 2d) |
Show 5 other places
SKILL.md:37In the instructionsOpen original file
```bashgws events +renew --name subscriptions/SUB_IDgws events +renew --all --within 2d```
SKILL.md:43In the instructionsOpen original file
- Subscriptions expire if not renewed periodically.- Use --all with a cron job to keep subscriptions alive.
SKILL.md:31In the instructionsOpen original file
| `--name` | — | — | Subscription name to reactivate (e.g., subscriptions/SUB_ID) || `--all` | — | — | Renew all subscriptions expiring within --within window || `--within` | — | 1h | Time window for --all (e.g., 1h, 30m, 2d) |
SKILL.md:32In the instructionsOpen original file
| `--all` | — | — | Renew all subscriptions expiring within --within window || `--within` | — | 1h | Time window for --all (e.g., 1h, 30m, 2d) |
SKILL.md:44In the instructionsOpen original file
- Subscriptions expire if not renewed periodically.- Use --all with a cron job to keep subscriptions alive.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This Skill uses `gws events +renew` to reactivate or renew Google Workspace Events subscriptions, either by a specific subscription name or in bulk for subscriptions expiring within a time window.

View source
SKILL.md:23In the instructionsOpen original file
```bashgws events +renew```
SKILL.md:30In the instructionsOpen original file
|------|----------|---------|-------------|| `--name` | — | — | Subscription name to reactivate (e.g., subscriptions/SUB_ID) || `--all` | — | — | Renew all subscriptions expiring within --within window || `--within` | — | 1h | Time window for --all (e.g., 1h, 30m, 2d) |

It depends on the external `gws` program and an adjacent shared Skill for authentication, global flags, and security rules; those shared instructions are not included in the supplied material. If the shared Skill is missing, the instructions direct the agent to run a generation command.

View source
SKILL.md:8In the instructionsOpen original file
    category: "productivity"    requires:      bins:        - gws    cliHelp: "gws events +renew --help"---
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Start here · InstructionsSKILL.md
gws-events-renew
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:22In the instructionsOpen original file
```bashgws events +renew
SKILL.md:36In the instructionsOpen original file
```bashgws events +renew --name subscriptions/SUB_ID
Lines read
50
File checksum (to compare versions)
6118f5c98e805042d191e20c27f286202f762ad683c0c806c9f91ca94e520b93